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1. INTRODUCTION 

One of the most important notions in probability theory is that of expectation. 
The expected value of a random variable is, in a sense, the single number that 
best describes the random variable. While probability is certainly still the most 
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dominant approach to representing uncertainty, in the past two decades there 
has been a great deal of interest in alternative representations of uncertainty, 
both from a normative and descriptive point of view. This may seem somewhat 
surprising to those familiar with the many arguments that have been made showing 
that probability is the only rational approach to representing uncertainty (see, for 
example, Cox [1946], Ramsey [1931], de Finctti [1931], Savage [1954]). However, all 
these arguments depend on assumptions, perhaps the most controversial of which 
is that the uncertainty of an event can be completely characterized by a single 
number. (See Walley [1991] for a good summary of the arguments for the need to 
occasionally go beyond probabilistic expectation.) Some alternatives to probability 
in the literature include sets of probability measure [Huber 1981; Walley 1991], 
Dempster-Shafer belief functions [Shafer 1976] and the closely related nonadditive 
measures [Schmeidler 1989], and possibility measures [Dubois and Prade 1990]. 

In this paper, we consider the notion of expectation for all these representations 
of uncertainty. We do not take a stand here on what the "right" way is to represent 
uncertainty; we simply investigate characterizations of expectation and reasoning 
about expectation, both for probability and for other representations of uncertainty. 

It is well known that a probability measure determines a unique expectation 
function that is linear (i.e., E(aX + bY) = aE(X) + bE(Y)), monotone (i.e., X < Y 
implies E{X) < E(Y)), and maps constant functions to their value. Conversely, 
given an expectation function E (that is, a function from random variables to the 
reals) that is linear, monotone, and maps constant functions to their value, there 
is a unique probability measure [i such that E — E^. That is, there is a 1-1 
mapping from probability measures to (probabilistic) expectation functions. One 
of the goals of this paper is to provide similar characterizations of expectation for 
other representations of uncertainty. 

Some work along these lines has already been done, particulary with regard to 
sets of probability measures [Huber 1981; Walley 1991; 1981]. 1 However, there 
seems to be surprisingly little work on characterizing expectation in the context of 
other measures of uncertainty, such as belief functions [Shafer 1976] and possibility 
measures [Dubois and Prade 1990]. We provide characterizations here. 

Having characterized expectation functions, we then turn to the problem of 
reasoning about them. We define a logic similar in spirit to that introduced by 
Fagin et al. [1990] (FHM from now on) for reasoning about likelihood expressed 
as either probability or belief. The same logic is used by Halpern and Pucella 
[2002a] (HP from now on) for reasoning about upper probabilities. The logic for 
reasoning about expectation is strictly more expressive than its counterpart for 
reasoning about likelihood if the underlying semantics is given in terms of sets 
of probability measures (so that upper probabilities and upper expectations are 
used, respectively); it turns out to be equi-expressive in the case of probability, 
belief functions, and possibility measures. This is somewhat surprising, especially 
in the case of belief functions. In all cases, the fact that expectations are at least as 
expressive is immediate, since the expectation of if (viewed as an indicator function, 
that is, the random variable that is 1 in worlds where ip is true and otherwise) 

1 Walley [1991] actually characterizes lower and upper previsions; but these are essentially lower 
and upper expectations with respect to sets of probability measures. 
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is equal to its likelihood. However, it is not always obvious how to express the 
expectation of a random variable in terms of likelihood. 

We then provide a sound and complete axiomatization for the logic with respect 
to each of the interpretations of expectation that we consider, using our characteri- 
zation of expectation. Finally, we show that, just as in the case of the corresponding 
logic for reasoning about likelihood, the complexity of the satisfiability problem is 
NP-complete. This is clear when the underlying semantics is given in terms of 
probability measures, belief functions, or possibility measures, but it is perhaps 
surprising that, despite the added expressiveness in the case of sets of probability 
measures, reasoning in the logic remains NP-complete. 

To the best of our knowledge, there is only one previous attempt to express 
properties of expectation in a logical setting. Wilson and Moral [1994] take as their 
starting point Walley's notion of lower and upper previsions. They consider when 
acceptance of one set of gambles implies acceptance of another gamble. This is 
a notion that is easily expressible in our logic when the original set of gambles is 
finite, so our logic subsumes theirs in the finite case. 

This paper is organized as follows. In the next section, the characterizations of 
expectation for probability measures and sets of probability measures arc reviewed, 
and the characterizations of expectation for belief functions and possibility measures 
are provided. In Section 3, we introduce a logic for reasoning about expectation 
with respect to all these representations of uncertainty. In Section 4, we compare 
the expressive power of our expectation logic to that of the logic for reasoning 
about likelihood. In Section 5, we derive sound and complete axiomatizations for 
the logic in Section 3, with respect to different representations of uncertainty. In 
Section 6, we prove that the decision problem for the expectation logic is NP- 
complete for each of the representations of uncertainty we consider. Finally, in 
Section 7, we discuss an axiomatization of gamble inequalities, which is assumed 
by the axiomatizations given in Section 5. The proofs of the more technical results 
are given in the appendix. 

2. EXPECTATION FUNCTIONS 

Recall that a random variable X on a sample space (set of possible worlds) W is 
a function from W to some range. Let V(X) denote the image of X, that is, the 
possible values of X. A gamble is a random variable whose range is the reals. In 
this paper, we focus on the expectation of gambles. Additionally, we restrict to 
finite sample spaces; most of the issues of interest already arise in the finite sample 
space setting. (Most of the results in this section extend in a straightforward way 
to the infinite sample space setting, by adding suitable continuity assumptions on 
the measures defined. See Halpern [2003] for more detail.) Note that if the sample 
space is finite, the range V(X) of a gamble X is finite. This allows us to define 
expectation using summation rather than integration. 

2.1 Expectation for Probability Measures 

Given a finite sample space W, and a probability measure \x and gamble X over 
W, the expected value of X (or the expectation of X) with respect to /i, denoted 
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E^X), is just 



(i) 



wew 



Thus, the expected value of a gamble is essentially the "average" value of the 
variable. 

Actually, (1) makes sense only if every singleton is measurable (i.e., in the domain 
of /j). If singletons are not necessarily measurable, the standard assumption is that 
X is measurable with respect to the algebra T on which /i is defined; that is, for each 
value x e V(X), the set of worlds X = x where X takes on value x is measurable. 2 
(In general, a function f : W W is measurable with respect to T if f^ 1 (w') e T 
for all v/eW.) Then' 



Note that this definition makes sense even if W is not finite, so long as V{X) is 
finite. It is easy to check that (1) and (2) are equivalent if W is finite and all 
singletons arc measurable. 

As is well known, probabilistic expectation functions can be characterized by a 
small collection of properties. If X and Y are gambles on W and a and b are real 
numbers, define the gamble aX + bY on W in the obvious way: (aX + bY)(w) — 
aX(w) + bY(w). Say that X < Y if X(w) < Y(w) for all w e W. Let ~c denote the 
constant function which always returns c; that is, c(w) = c. Let \i be a probability 
measure on W. 

Proposition 2.1. The function has the following properties for all measur- 
able gambles X and Y . 

(a) E^ is additive: E^X + Y) = E^X) + E^Y). 

(b) E„ is affinely homogeneous: E^(aX + b) = aE^(X) + b for all a,d€R. 

(c) E^ is monotone: if X < Y, then E^X) < E^Y). 

PROOF. See any standard text in probability or discrete mathematics [Billingsley 
1995] □ 

The next result shows that the properties in Proposition 2. 1 essentially character- 
ize probabilistic expectation functions. It too is well known. We provide the proof 
here, just to show how the assumptions are used. In the proof (and throughout 
the paper) we make use of a special type of random variable. Let Xjj denote the 
gamble such that Xjj(w) = 1 if w € U and Xjj(w) = if w £ U. A gamble of the 
form Xjj is traditionally called an indicator function. 

Theorem 2.2. Suppose that E maps gambles measurable with respect to some 
algebra T toR and E is additive, affinely homogeneous, and monotone. Then there 
is a (necessarily unique) probability measure \i on T such that E = E^. 



2 Recall that an algebra T over a sample space W is a set of subsets of W that includes W itself 
and is closed under complementation and union, so that if U, V S T then so is U and U U V. 




(2) 



xdV(X) 
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PROOF. Define n(U) = E(Xu). Note that X w = 1, so fi(W) = 1, since E is 
affincly homogeneous. Since X is and E is affincly homogeneous, it follows that 
/u(0) = E(X ) = 0. X < X[/ < Xw for all J7 C W; since i£ is monotone, it 
follows that = E(X ) < E(X V ) = n(U) < E(X W ) = 1. If [/ and V are disjoint, 
then it is easy to see that X UuV = X v + X v . By additivity, 

li(U UV) = E(X UUV ) = E{Xu) + E(X V ) = M (C/) + fi(V). 

Thus, \i is indeed a probability measure. 

To see that E = E^, note that it is immediate from (2) that n(U) = E^Xjj) for 
U € T . Thus, Ep and E agree on all measurable indicator functions. Every mea- 
surable gamble X can be written as a linear combination of measurable indicator 
functions. For each a E V(X), let Ux, a — {w : X(w) = a}. Since X is a measurable 
gamble, Ux, a must be in T . Moreover, X = X^aev(x) a ^-u x a - By additivity and 
afiine homogeneity, E^(X) = J2aev(X) a E(Xu x ,a)- By Proposition 2.1, E^(X) = 
J2aev(x) a ^iJ.{^Ux,a)- Since _E and E^ agree on measurable indicator functions, it 
follows that E(X) = E^X). Thus, E = E^ as desired. 

Clearly, if //(?/) 7^ l^'(U), then E^(Xu) ^= E^(Xu). Thus, /U is the unique 
probability measure on T such that E = E^. □ 

2.2 Expectation for Sets of Probability Measures 

If V is a set of probability measures on a space VF, define 

V4U) = mf{n(U) : fieP} and 
P*(t/) = sup{/i(tf) : M e-p}. 

V*(U) is called the tower probability of J7 and T*(U) is called the wpper probability 
of {/. Lower and upper probabilities have been well studied in the literature (see, 
for example, Borel [1943], Smith [1961]). 

There arc straightforward analogues of lower and upper probability in the context 
of expectation. If V is a set of probability measures such that X is measurable with 
respect to each probability measure \i <G V, then define E-p(X) = {E^(X) : /j, e V}. 
E-p(X) is a set of numbers. Define the lower expectation and upper expectation of 
X with respect to V, denoted E V (X) and E-p(X), as the inf and sup of the set 
E-p(X), respectively. 

The properties of E v and E-p are not so different from those of probabilistic 
expectation functions. Note that E^Xjj) — fi(U). Similarly, it is easy to see 
that P*(U) = E v {Xu) and T*(U) = E V {X V ). Moreover, we have the following 
analogue of Propositions 2.1. 

Proposition 2.3. The functions E_ v and E-p have the following properties for 
all gambles X and Y. 

(a) _E v (X + Y) ^_E V (X) +_E V (Y) fsupcradditivity j; 
E r (X + Y) < E V (X) + E V (Y) fsubadditivityj. 

(b) E v and E-p are both positively affinely homogeneous: E v (aX+b) = aE v (X) + 
b and E v (aX + b) = aE-p(X) + b if a, b <= R, a > 0. 

(c) Ep and E-p are monotone. 

(d) Ep(X) = -Ep(-X). 
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PROOF. This result is also well-known; see Walley [1991, Section 2.6.1]. (Walley 
proves the result for what he calls coherent lower and upper previsions, but then 
proves [Walley 1991, Section 3.3.4] that these are equivalent to lower and upper 
expectations, respectively.) □ 

Supcradditivity (resp., subadditivity) , positive affine homogeneity, and mono- 
tonicity in fact characterize E v (resp., Ep). 

Theorem 2.4. [Huber 1981] Suppose that E maps gambles measurable with 
respect to T to R and is superadditive (resp., subadditive), positively affinely homo- 
geneous, and monotone. Then there is a set V of probability measures on T such 
that E = E V (resp., E — ~Ep ). 3 

The set V constructed in Theorem 2.4 is not unique. It is not hard to construct 
sets V and V such that V ^ V but E_ v = E_ v , . However, there is a canonical largest 
set V such that E = E v ; V consists of all probability measures \x such that E^X) > 
E(X) for all gambles X. This set V can be shown to be closed and convex. Indeed, 
it easily follows that Theorem 2.4 actually provides a 1-1 mapping from closed, 
convex sets of probability measures to lower/upper expectations. Moreover, in a 
precise sense, this is the best we can do. If V and V have the same convex closure 
(where the convex closure of a set is the smallest closed, convex set containing it), 
then E_ v = E v , . 

As Walley [1991] shows, what he calls coherent lower/upper previsions are also 
lower/upper expectations with respect to some set of probability measures. Thus, 
lower/upper previsions can be identified with closed, convex sets of probability 
measures. 

2.3 Expectation for Belief Functions 

As is well known, a belief function [Shafcr 1976] Bel is a function from subsets of a 
state space W to [0, 1] satisfying the following three properties: 

Bl. Bel(0) = 0. 

B2. Bel(W) = 1. 

B3. For n = 1,2,3,..., 

Bel(UU^) > Er=iE { /c { i,... > „ }: |7|= i} (- 1 ) i+lB el(ae/^)- 
Given a belief function Bel, there is a corresponding plausibility function Plaus, 
where Plaus (17) = 1 - Bel(!7). It follows easily from B3 that Bel(C) < Plaus([/) 
for all U C W. Bel(J7 ) can be thought of as a lower bound of a set of probabilities 
and Plaus(?7) can be thought of as the corresponding upper bound. This intuition 
is made precise in the following well-known result. 

Theorem 2.5. [Dempster 1967] Given a belief function Bel defined on W, let 
VbcI = {/i ■■ V{U) > Bel(f7) for all U C W}. Then Bel = (P Bo i)*- 4 



'^Thcrc is an equivalent characterization of E v , due to Walley [1991]. He shows that E = E v 
for some set V of probability measures iff E is superadditive, E(cX) = cE(X), and E(X) > 
in{{X(w) : w £ W}. There is an analogous characterization of E-p. 

4 Dempster [1967] defines V Bcl as {fi : Plaus(C7) > n(U) > Bcl(C7) for all U C W}, but his 
definition is easily seen to be equivalent to that given here. For if p,(U) > Be\(U) for all U C W 
then, in particular, n(U) > BeUU), so Plaus(J7) = 1 - Bel(F) > 1 - p,(U) = fi{U). 
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Fig. 1. Two equivalent definitions of probabilistic expectation. 

Similarly, we can check that Plaus(J7) = 1 — Bcl([7) = (Vbci)* ■ There is an 
obvious way to define a notion of expectation based on belief functions, using the 
identification of Bel with (Vbc\)*- Given a belief function Bel, define £?Bci = E Vbo1 . 
Similarly, for the corresponding plausibility function Plaus, define -Epiaus = E-p Bo] . 
(These definitions arc in fact used by Dempster [1967]). 

This is well defined, but it seems more natural to get a notion of expectation for 
belief functions that is defined purely in terms of belief functions, without reverting 
to probability. One way of doing so is due to Choquet [1953]. 5 

It takes as its point of departure the following alternate definition of expecta- 
tion in the case of probability. Suppose that X is a gamble such that V(X) = 
{xi, . . .,x n }, with xi < ... <x n . 

Proposition 2.6. E^(X) = X! + (x 2 - xi) n(X > x x )h \- (x n - x n -i) n(X > 

X n -l). 

PROOF. Figure 1 should help make clear why this result is true, where we assume 
for simplicity that the worlds W — {wi, w 2 , ■ ■ ■} are ordered such that if X(wi) < 
X(vjj), then i < j. If we assume that the probability of a world Wi is the width 
of the vertical rectangle over Wi, then it should be clear that the total area of 
the rectangles represent the expectation of X. Notice that the vertical rectangles 
determine the expectation using the standard definition (2), while the horizontal 
rectangles determine the expectation using the formula in this proposition. 

For a more formal proof, suppose that V(X) — {xi, . . . ,x n }, where X\ < . . . < 
x n . We proceed by induction on n. If n = 1, the result is trivial, since clearly 
E^(X) = xi. If n > 1, then note that X = Xi + X 2 , where Xi(w) = X(w) if 
X(w) 7^ x n , and X\(w) — x„_i if X{w) — x n , and X 2 (w) = if X(w) ^ x n , 
and X(w) = x n — x n -\ if X(w) = x n . Clearly X = X\ + X 2 , so by additivity, 
E{X) = E(X 1 ) + E(X 2 ). Note that V{X{) = {x 1 , . . . ,a;„_i}, so by the induction 
hypothesis, E^Xi) = xi + (x 2 - x^^X > X\) H h (a;„_i - x n _ 2 ){i(X > x„_ 2 )- 



5 Choquet actually talked about A;- monotone capacities, which are essentially functions that satisfy 
B3 where n = 1, . . . , k. Belief functions are infinitely monotone capacities. 
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Finally, it is immediate from the definition of X 2 that E^X^) — (x n — x n -i)(j,(X > 
x n -i). The result follows immediately. □ 

Define 

E^JX) = Xl + (x 2 - Xl )Bel{X > Xl ) + ■ ■ ■ + {x n - x„_ 1 )Bcl(X > i n _i). (3) 
An analogous definition holds for plausibility: 

Ep laus (X) = xi + (x 2 - a;i)Plaus(X > x\) H h (x n - x„_i)Plaus(A" > ir„_i). 

(4) 

Proposition 2.7. [Schmeidler 1989] E Bcl = E' Bcl and E PUns = E' plaus . 

Schmcidler [1986; 1989] actually used Choquet's definition to define a notion 
of expectation for what he called nonadditive probabilities, where a nonadditive 
probability v maps subsets of a space W to [0, 1] such that v{0) = 0, u{W) = 1, 
and v(U) < v(V) HU QV. He proved an analogue of Proposition 2.7 for arbitrary 
nonadditive probabilities. Since belief functions and plausibility functions are both 
nonadditive probabilities in Schmcidler's sense, Proposition 2.7 is actually a special 
case of Schmcidler's result. 

Proposition 2.7 shows that (3) gives a way of defining expectation for belief 
functions without referring to probability. There is yet a third way of defining 
expectation for belief functions, which also does not use probability; see the proof 
of Theorem 6.2 in Appendix A. 4. 

Since i? Bo i can be viewed as a special case of the lower expectation E v (tak- 
ing V = "Pbci), it is immediate from Proposition 2.3 that £"bo1 is superadditive, 
positively affincly homogeneous, and monotone. (Similar remarks hold for -Epiaus, 
except that it is subadditive. For ease of exposition, we focus on E-q c \ in the 
remainder of this section, although analogous remarks hold for -Epi aU s-) 

Since it is immediate from the definition that E-Q e \{Xu) = Bel(Z7), the inclusion- 
exclusion property B3 of belief functions can be expressed in terms of expectation 
(just by replacing all instances of Bel(T^) in B3 by E-Bci(Xv)) ■ Moreover, it does not 
follow from the other properties, since it can be shown not to hold for arbitrary lower 
probabilities. This restatement of the inclusion-exclusion property applies only to 
the expectation of indicator functions. But, in fact, a more general inclusion- 
exclusion property holds for E Bcl . Given gambles X and Y, define the gambles 
X A Y and IVY as the minimum and maximum of X and Y, respectively; that 
is, (X AY)(w) = min(X (w),Y(w)) and (XVY)(w) = max.(X(w),Y(w)). Consider 
the following inclusion-exclusion property for expectation functions: 

n 

E(VUXi) >£ ]T ( — l) i+1 E(Aj e iXj). (5) 

i=1 {■fC{l,...,n}:|7|=i} 

Since it is immediate that Xjjuv — XyVXy and Xjj n v — Xjj hXy, (5) generalizes 
B3. We recover B3 from (5) by taking Xi to be the indicator function X\j i . 

There is yet another property satisfied by expectation functions based on belief 
functions. Two gambles X and Y are said to be comonotonic if it is not the case 
that one increases while the other decreases. Formally, this means that there do 
not exist worlds w and w' such that (X(w) - X(w'))(Y(w) - Y(w')) < 0. The 
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property satisfied by expectation based on belief functions is called comonotonic 
additivity: 

If X and Y arc comonotonic, then E(X + Y) = E{X) + E{Y). (6) 

The fact that -E Bo i satisfies this property was essentially recognized by Dellacherie 
[1970]. 

Proposition 2.8. The function Eb c \ is superadditive, positively affinely homo- 
geneous, monotone, and satisfies (5) and (6). e 

Proof. See Appendix A. 1. □ 

Theorem 2.9. Suppose that E is an expectation function that is positively affinely 
homogeneous, monotone, and satisfies (5) and (6). Then there is a (necessarily 
unique) belief function Bel such that E = Eb c \- 

Proof. See Appendix A. 1. □ 

Schmcidler [1986] proved that expectation functions for nonadditive measures 
are characterized by positive afiine homogeneity monotonicity, and comonotonicity. 
Theorem 2.9 shows that the inclusion-exclusion property (5) is what distinguishes 
expectation for belief functions from expectation for arbitrary nonadditive mea- 
sures. Note that superadditivity was not assumed in the statement of Theorem 2.9. 
Indeed, it is a consequence of Theorem 2.9 that superadditivity follows from the 
other properties. In fact, the full stcngth of positive afiine homogeneity is not 
needed either in Theorem 2.9. It suffices to assume that E(b) = b. 

Corollary 2.10. Given a belief function Bel, -Esci * s the unique expectation 
function E that is superadditive, positively affinely homogeneous, monotone, and 
satisfies (5) and (6) such that E{X V ) = Bel(C7) for all U CW. 

Proof. Proposition 2.8 shows that Eb c \ has the required properties. If E' is 
an expectation function that has these properties, by Theorem 2.9, E' = E Be i' for 
some belief function Bel'. Since E'(X V ) = Be\'(U) = Bcl([7) for all U C W, it 
follows that Bel = Bel'. □ 

Corollary 2.10 is somewhat surprising. While it is almost immediate that an 
additive, affinely homogeneous expectation function (the type that arises from a 
probability measure) is determined by its behavior on indicator functions, it is 
not at all obvious that a superadditive, positively afiine homogeneous expectation 
function should be determined by its behavior on indicator functions. In fact, in 
general it is not; the inclusion-exclusion property is essential. Corollary 2.10 says 
that Bel and E'eei contain the same information. Thus, so do (7- > Bei)* and i^p Bol 
(since Bel = (T^Bei)* and Eb c i = E Vbo1 ). However, this is not true for arbitrary sets 
V of probability measures, as the following example shows. 

Example 2.11. Let W = {1,2,3}. A probability measure \i on W can be 
characterized by a triple (01,02,03), where fi(i) — a^. Let V consist of the three 



6 In a preliminary version of this paper [Halpern and Pucclla 2002b] we used a different character- 
ization of expectation functions, based on belief functions. The current characterization is much 
simpler. 
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probability measures (0, 3/8, 5/8), (5/8, 0, 3/8), and (3/8, 5/8, 0). It is almost imme- 
diate that V* is on singleton subsets of W and V* =3/8 for doubleton subsets. Let 
V = VU{^i}, where ^ 4 = (5/8, 3/8, 0). It is easy to check that VI =V*. However, 
E v ^ E_ v ,. In particular, let X be the gamble such that X(l) = 1, X(2) = 2, and 
X(3) = 3. Then E V {X) = 13/8 but E V ,{X) = 11/8. Thus, although E v and 
E_ v , agree on indicator functions, they do not agree on all gambles. In light of the 
discussion above, it should be no surprise that V* is not a belief function. | 

2.4 Expectation for Possibility Measures 

A possibility measure Poss is a function from subsets of W to [0, 1] such that 

Possl. Poss(0) = 0. 
Poss2. Poss(IT) = 1. 

Poss3. Poss([/U V) = max(Poss(J7),Poss(y)) if U and V are disjoint. 

It is not hard to show that Poss3 implies that Poss(J7Ul / ) = max(Poss(f7), Poss(V)) 
even when U and V are not disjoint. 

It is well known [Dubois and Prade 1982] that possibility measures are special 
cases of plausibility functions. Thus, (4) can be used to define a notion of possi- 
bilistic expectation; indeed, this has been done in the literature [Dubois and Prade 
1987]. It is also straightforward to see from Poss3 that the expectation function 
Eposs defined from a possibility measure Poss in this way satisfies the following max 
property defined in terms of indicator functions: 

Eposs(Xuuv) = niax(£p oss (Xr/), E Poss (X v )- (7) 

Proposition 2.12. The function E Poss is positively affinely homogeneous, mono- 
tone, and satisfies (6) and (7). 

Proof. See Appendix A.l. □ 

Theorem 2.13. Suppose that E is an expectation function that is positively 
affinely homogeneous, monotone, and satisfies (6) and (7). Then there is a (neces- 
sarily unique ) possibility measure Poss such that E = Ep oss . 

PROOF. See Appendix A.l. □ 

Note that, although Poss is a plausibility measure, and thus satisfies the analogue 
of (5) with > replaced by <, there is no need to state (5) explicitly; it follows 
from (7). Moreover, just as with expectation for belief functions, it follows from 
the other properties that -Ep oss is subadditive. (Since a possibility measure is a 
plausibility function, not a belief function, the corresponding expectation function 
is subadditive rather than superadditive.) 

3. A LOGIC FOR REASONING ABOUT EXPECTATION 

We now consider a logic for reasoning about expectation. To set the stage, we 
briefly review the FHM logic for reasoning about likelihood. 
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3.1 Reasoning about Likelihood 

The syntax of the FHM logic is straightforward. Fix a set <J>n = {Pi,P2, ■ ■ ■} of 
primitive propositions. The choice of primitive propositions is application depen- 
dent. The set of primitive propositions could include statements such as "the 
patient has cancer" and "the patient has fever" if we are reasoning in a medical 
domain, or statements such as "the price of IBM stock is over $80" if we are 
considering a financial domain. The set $ of propositional formulas is the closure 
of $o under A and -■. We can define V and => in the usual way; we use the 
operators freely throughout the paper. We assume a special propositional formula 
true, and abbreviate ^true as false. A basic likelihood formula has the form 
ai£(ipi) + • • • + a k £(pk) > b, where a\, . . . , a^, b are integers and ipi, . . . , ifk are 
propositional formulas. 7 The I stands for likelihood. Thus, a basic likelihood 
formula talks about a linear combination of likelihood terms of the form £i(<p). A 
likelihood formula is a Boolean combination of basic likelihood formulas. Let C® u 
be the language consisting of likelihood formulas. (The QU stands for quantitative 
uncertainty. The name for the logic is taken from Halpcrn [2003].) 

We use standard abbreviations such as —£{p) for (—l)£(ip), and formulas £(<pi) > 
£{p>2) for £(ipi) — £{p2) > 0. In addition, we write ai£(ip\) + . . . + ak£(<Pk) < b for 
-ait{<pi) - ... - a k £(ip k ) > -b, ail(tpi) + . . . + a k £(ip k ) > b for ^(a 1 £(<^ 1 ) + . . . + 
ak£(.Vk) < b), ai%>i) + . . . + a k £((fik) < b for -a^ipi) - • ■ • - a k £((p k ) > ~b, and 
ai£((fii) + . . . + a k £((fik) = b for (ai^(^i) + . . . + a k £(pk) > b) A (ai^(^i) + . . . + 
a k £(<p k ) < b). 

The semantics of CP U depends on how £ is interpreted. In FHM, it is interpreted 
as a probability measure and as a belief function; in HP, it is interpreted as an 
upper probability (determined by a set of probability measures) . Depending on the 
interpretation, £(<p) is the probability of ip (i.e., more precisely, the probability of 
the set of worlds where ip is true), the belief in ip, etc. For example, in the case 
of probability, define a probability structure to be a tuple M = (W, T, /j,, ir), where 
W is a (possibly infinite) set of worlds, \i is a probability measure whose domain 
is the algebra T of subsets of W, and tt is an interpretation, which associates with 
each state (or world) in W a truth assignment on the primitive propositions in <j> . 
Thus, 7r(s)(p) € {true, false} for s e W and p e <& . We require that primitive 
propositions be measurable, that is, that {s e W : n(s)(p) = true} € T for all 
p € <&o- Extend ir(s) to a truth assignment on all propositional formulas in the 
standard way, and associate with each propositional formula the set [<p\m = { s G 
W : ir(s)(<p) = true}. Note that \<p\m is measurable for all p since T is an 
algebra. Then 

M |= ai£(ipi) H h a n £(ip n ) > b iff ai/i([<pi] M ) H 1- a n ^(lp n j M ) > b. 

The semantics of Boolean combinations of basic likelihood formulas is given in the 

7 As observed in FHM, we gain no further generality by allowing the coefficients 01, . . . , ajt to be 
rational numbers, since for any formula with rational coefficients, we can easily find an equivalent 
formula with coefficients that are integers by clearing the dominator. There is no difficulty giving 
semantics to formulas where the coefficients arc arbitrary real numbers (and, indeed, this is what 
we did in a preliminary version of the paper [Halpern and Pucclla 2002b]), but allowing real 
numbers causes problems in the complexity results. (In the preliminary version, we restricted to 
integer coefficients for the complexity results.) 
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obvious way. 

We can similarly give semantics to I using lower (or upper) probability. Define 
a lower probability structure to be a tuple M = (W, T, V, it), W, T and 7r are, 
as before, a (possibly infinite) set of worlds, an algebra of subsets of W, and an 
interpretation that makes each primitive proposition measurable, and V is a set of 
probability measures over T . Likelihood is interpreted as lower probability in lower 
probability structures: 8 

M h ai%i) + • • • + a„% n ) > b iff aiP,(fo>i] M ) + • • • + a n V*{y n \ M ) > b. 

A belief structure has the form M = (W,Bel,n), where Bel is a belief function. 
We can interpret likelihood formulas with respect to belief structures in the obvious 
way. Similarly, a possibility structure has the form M = (W, Poss, 7r), where Poss 
is a possibility measure. Again, we interpret likelihood formulas with respect to 
possibility structures in the obvious way. 

Let M prob , M lp , M bel , and M poss denote the set of all probability structures, 
lower probability structures, belief structures, and possibility structures, respec- 
tively. 

3.2 Reasoning about Expectation 

Our logic for reasoning about expectation is similar in spirit to Cf* u . The idea is to 
interpret a propositional formula ip as the indicator function Xt v j M , which is 1 in 
worlds where ip is true, and otherwise. We can then take linear combinations of 
such gambles. Formally, we again start with a set $0 of primitive propositions. A 
(linear) propositional gamble has the form b\ipi + • • • + b n ip n , where b\, . . . ,b n are 
integers and ipi , . . . , ip n are propositional formulas that mention only the primitive 
propositions in <j> . We use 7 to represent propositional gambles. An expectation 
inequality is a statement of the form aie(7i) + • • • + a k e("f k ) > b, where a\ . . . , a k 
arc integers, k > 1, and b is an integer. An expectation formula is a Boolean 
combination of expectation inequalities. We use / and g to represent expectation 
formulas. We define <, >, <, and = just as in Section 3.1, Let C E be the language 
consisting of expectation formulas. 

Given a model M, we associate with a propositional gamble 7 the gamble {^m, 

where {]&i<£H Vb n Lp n \ M = &i^[ V i]„H \~b n Xy n j M . Of course, the intention is 

to interpret e(j) in M as the expected value of the gamble |7|}m, where the notion 
of "expected value" depends on the underlying semantics. In the case of probability 
structures, it is probabilistic expectation; in the case of belief structures, it is 
expected belief; in the case of lower probability structures, it is lower expectation; 
and so on. For example, if M e M prob , then 

M |= aie(7i) + • • • + a k e{ lk ) > b iff ai£^7iM + ■ ■ ■ + a k E^ lk \ M ) > b. 

Again, Boolean combinations are defined in the obvious way. We leave the 
obvious semantic definitions in the case of belief structures and lower probability 
structures to the reader. 



8 In HP, wc interpreted likelihood as upper probability. We interpret it here as lower probability 
to bring out the connections to belief, which is an instance of lower probability. It is easy to 
translate from upper probabilities to lower probabilities and vice versa, since V*(U) = 1 — V*(U). 
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4. EXPRESSIVE POWER 

It is easy to see that C E is at least as expressive as C® u . Since the expected value 
of an indicator function is its likelihood, for all the notions of likelihood we are 
considering, replacing all occurrences of £(ip) in a formula in CP U by e{ip) gives an 
equivalent formula in C E . Is C E strictly more expressive than CP U 1 That depends 
on the underlying semantics. 

In the case of probability, it is easy to see that it is not. Using additivity and 
affine homogeneity, it is easy to take an arbitrary formula / G C E and find a formula 
/' G C E that is equivalent to / (with respect to structures in J\A proh ) such that e 
is applied only to propositional formulas. Then using the equivalence of e(<p) and 
£(<p), we can find a formula f T G £® u equivalent to / with respect to structures 
in A4 prob . It should be clear that the translation / to f T causes at most a linear 
blowup in the size of the formula. 

The same is true if we interpret formulas with respect to M bel and A4 poss . In both 
cases, given a formula / G C E , we can use (6) to find a formula /' G C E equivalent 
to / such that e is applied only to propositional formulas (see Lemma A. 5 in the 
appendix). It is then easy to find a formula f T G £® u equivalent to /' with respect 
to structures in J\A bel and Ai poss . However, now the translation from / to f T can 
cause an exponential blowup in the size of the formula; we do not know if there is 
a shorter translation. 

What about lower expectation/probability? In this case, C E is strictly more 
expressive than £® u . It is not hard to construct two structures in M lp that agree 
on all formulas in £® u but disagree on formulas in C E such as e(p+q) > 1/2. That 
means that there cannot be a formula in CP U equivalent to e(p + q) > 1/2. 

The following theorem summarizes this discussion. 

Theorem 4.1. C E and C QU are equivalent in expressive power with respect to 
M prob , M bel , and M poss . C E is strictly more expressive than Cfi u with respect to 
M lp . 

Proof. See Appendix A. 2. □ 

5. AXIOMATIZING expectation 

In FHM, a sound and complete axiomatization is provided for £® u both with 
respect to M. p and A4 bel ; in HP, a sound and complete axiomatization is provided 
for £® u with respect to M lp . Here we provide a sound and complete axiomatization 
for C E with respect to these structures, as well as with respect to Ai poss . 

The axiomatization for £® u given in FHM splits into three parts, dealing re- 
spectively with propositional reasoning, reasoning about linear inequalities, and 
reasoning about likelihood. We follow the same pattern here. The following axioms 
characterize propositional reasoning: 

Taut. All instances of propositional tautologies in the language C E . 
MP. From / and / =>• g infer g. 

Instances of Taut include all formulas of the form /V->/, where / is an expectation 
formula. We could replace Taut by a simple collection of axioms that characterize 
propositional reasoning (see, for example, Mendclson [1964]), but we have chosen 
to focus on aspects of reasoning about expectations. 
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The following axiom characterizes reasoning about linear inequalities: 

Ineq. All instances in C E of valid formulas about linear inequalities. 

This axiom is taken from FHM. There, an inequality formula is taken to be a 
Boolean combination of formulas of the form a\X\ + • • • + a n x n > c, over variables 
Xi, . . . , x n . Such a formula is valid if the resulting inequality holds under every 
possible assignment of real numbers to variables. To get an instance of Ineq, we 
replace each variable x t that occurs in a valid formula about linear inequalities by 
a primitive expectation term of the form e("/i) (naturally each occurrence of the 
variable Xi must be replaced by the same primitive expectation term e(7i)). As with 
Taut, we can replace Ineq by a sound and complete axiomatization for Boolean 
combinations of linear inequalities. One such axiomatization is given in FHM. It is 
described in Section 7; the details do not matter for the discussion in this section. 

The following axioms characterize probabilistic expectation in terms of the prop- 
erties described in Proposition 2.1. 

El. e(7i + 72) = e(7i) + e(j 2 ), 
E2. e(a(p) = ae(ip) for all a ER, 
E3. e(false) = 0, 
E4. e(true) = 1, 

E5. e(-fi) < e(7 2 ) if 71 < 72 is an instance of a valid formula about propositional 
gamble inequality (see below). 

Axiom El is simply additivity of expectations. Axioms E2, E3, and E4, in conjunc- 
tion with additivity, capture affine homogeneity. Axiom E5 captures monotonicity. 
A propositional gamble inequality is a formula of the form 71 < 72, where 71 and 
72 are propositional gambles. Examples of valid propositional gamble inequalities 
are p = pAg + pA ^q, <p < ip + ip, and ip < ^Vf We define the semantics 
of gamble inequalities more carefully in Section 7, where we provide a complete 
axiomatization for them. As in the case of Ineq, we can replace E5 by a sound 
and complete axiomatization for Boolean combinations of gamble inequalities. 9 

Let AX prob be the axiomatization {Taut, MP, Ineq, El, E2, E3, E4, E5}. As 
usual, given an axiom system AX, we say that a formula / is AX-provable if it can 
be proved in finitely many steps using the axioms and rules of inferences of AX. 
AX is sound with respect to a class M of structures if every AX-provable formula 
is valid in M. . AX is complete with respect to M if every formula that is valid in 
M. is AX-provable. 

Theorem 5.1. AX. prob is a sound and complete axiomatization of C E with 
respect to M prob . 

Proof. See Appendix A. 3. □ 



9 We could have taken a more complex language that contains both expectation formulas and 
gamble inequalities. We could then merge the axiomatizations for expectation formulas and gamble 
inequalities. For simplicity, and to clarify the relationship between reasoning about expectation 
versus reasoning about likelihood (see Section 4), we consider only the restricted language in this 
paper. 
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Despite the fact that we allow structures that have infinitely many worlds, we 
do not have axioms capturing the continuity properties of expectations that hold 
for expectations over infinite spaces. Roughly speaking, this is because the logic 
cannot distinguish between infinite sample spaces and finite ones. We make this 
intuition precise in Section 6. 

The characterizations of Theorems 2.4 and 2.9 suggest the appropriate axioms 
for reasoning about lower expectations and expected beliefs. The following axioms 
capture the properties specified in Proposition 2.3: 

E6. e(7i + 72) > e(7i) + e(j 2 ), 

E7. e(a7 + b true) = ae(-f) + b, for all a, b <E R, a > 0, 
E8. e(a7 + b false) = ae(j), for all a, b e R, a > 0. 

Axiom E6 is superadditivity of the expectation. Axioms E7 and E8 capture 
positive affine homogeneity Note that because we do not have additivity, we 
cannot get away with simpler axioms as in the case of probability. Monotonicity is 
captured, as in the case of probability measures, by axiom E5. Let AX lp be the 
axiomatization {Taut, MP, Ineq, E5, E6, E7, E8}. 

Theorem 5.2. AX !p is a sound and complete axiomatization of C E with respect 
to M lp . 

Proof. See Appendix A. 3. □ 

Although it would seem that Theorem 5.2 should follow easily from Proposi- 
tion 2.3, this is, unfortunately, not the case. As usual, soundness is straightforward, 
and to prove completeness, it suffices to show that if a formula / is consistent with 
AX ip , it is satisfiable in a structure in M lp . Indeed, it suffices to consider formulas / 
that are conjunctions of expectation inequalities and their negations. However, the 
usual approach for proving completeness in modal logic, which involves considering 
maximal consistent sets and canonical structures does not work. The problem is 
that there are maximal consistent sets of formulas that are not satisfiable. For 
example, there is a maximal consistent set of formulas that includes 6(7) > and 
e (l) < V n f° r n = 1,2, . . .; this is clearly unsatisfiable. A similar problem arises in 
the completeness proofs for CP U given in FHM and HP, but the techniques used 
there do not seem to suffice for dealing with expectations. 

Of course, it is the case that any expectation function that satisfies the constraints 
in the formula / and also every instance of axioms E6, E7, and E8 must be a lower 
expectation, by Theorem 2.4. The problem is that, a priori, there are infinitely 
many relevant instances of the axioms. To get completeness, we must reduce this 
to a finite number of instances of these axioms. It turns out that this can be done, 
using techniques from linear programming and Walley's [1991] notion of natural 
extension. 

It is also worth noting that, although C E is a more expressive language than Cfi u 
in the case of lower probability/expectation, the axiomatization for C E in this case 
is much more elegant than the corresponding axiomatization for C® u given in HP. 

We next consider expectation with respect to belief. As expected, the axioms 
capturing the interpretation of belief expectation rely on the properties pointed out 
in Proposition 2.8. Stating these properties in the logic requires a way to express 
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the max and min of two propositional gambles. It turns out that we can view 
the notation 71 V 72 as an abbreviation for a more complex expression. Given a 
propositional gamble 7 = b\ipi + ■ ■ ■ + b n ip n , we construct an equivalent gamble 
7' as follows. First define a family p A of propositional formulas indexed by A C 
{1, . . . , n} by taking p A = f\ ieA ipi A (A^a ~"Pj)- Thus, p A is true exactly if the 
ifii's for i E A are true, and the other ipj's are false. Note that the formulas p A are 
mutually exclusive. Define b A for AC {1, . . . ,n} by taking b A = ^2 ieA Define 
7' = J2ac{i n } ^aPa- It is easy to check that the propositional gambles 7 and 7' 
are equal. Given two propositional gambles, say 71 and 72, we can assume without 
loss of generality that the involve the same primitive propositions tpi, . . . ,<p n . (If 
not, we can always add "dummy" terms of the form Qtp.) Form the gambles j[ and 
7 2 as above. Since all the formulas mentioned in j[ and 7 2 are mutually exclusive, 
it follows that max(7^ , 7 2 ) = Xmc{i «} m ax(&A, b' A )p A . We take 71 V 72 to be an 
abbreviation for this gamble. (Note that if 71 and 72 are propositional formulas, 
then 71 V 72 really is a gamble equivalent to the propositional formula 71 V 72 , given 
our identification of propositional formulas with indicator functions, so the use of 
V is justified here.) Of course, we can similarly define 71 A 72, simply by taking min 
instead of max. 

With these definitions, the following axiom accounts for property (5): 
E9. e( 7 i V • • • V 7n ) > £?=i E { ,c { i,...,„ }: |/M } (-ir + MA je / 

To deal with the comonotonic additivity property (6), it seems that comonotonicity 
must be expresssed in the logic. It turns out that it suffices to capture only a 
restricted form of comonotonicity. Note that if ipi, . . . , ip m are pairwise mutually 
exclusive, a\ < . . . < a m , bi < . . . < b m , 71 = anpi + • • • + a m tp m , and 72 = 
bifi + • • • + b m ip m , then in all structures M, the gambles {]7i[}m and |72[}m are 
comonotonic. Thus, by (6), it follows that i?Bci(|7i +72^) = ^Bei(|7i|}-M ) + 
E Bcl (§j 2 ft m) ■ The proof that i?Boi satisfies comonotonic additivity (see the proof 
of Theorem 2.9 in the appendix) shows that it suffices to restrict to gambles of this 
form. These observations lead to the following axiom: 

E10. e(7!+7 2 ) = e(7i) + e(7 2 ) if 71 = a 1 ip 1 -\ \-a m ip m , j 2 = &i<PiH \-b m f m , 

a\ < . . . < a m , bi < . . . < b m , and ->((fii A ipj) is a propositional tautology 
for all i ^ j. 

Let AX ie! be the axiomatization {Taut, MP, Ineq, E5, E7, E8, E9, E10}. 

Theorem 5.3. AX 6el is a sound and complete axiomatization of C E with respect 
to M bel . 

Proof. See Appendix A. 3. □ 

Finally, we consider expectation with respect to possibility. The axioms capturing 
the interpretation of possibilistic expectation -Ep oss rely on the properties pointed 
out in Proposition 2.12. The max property (7) is captured by the following axiom: 

Ell. (e(<pi) > e{ip 2 )) ^ (e(pi V <p 2 ) = e(^)). 

Ell essentially says that e(<pi V tp 2 ) = max(e(<^i), e(ip 2 )). 

Let AX yoss be the axiomatization {Taut, MP, Ineq, E5, E7, E8, E10, Ell}. 
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Theorem 5.4. AX poss is a sound and complete axiomatization of C E with 
respect to M poss . 

Proof. See Appendix A. 3. □ 
6. DECISION PROCEDURES 

In FHM, it was shown that the satisfiability problem for C® u is NP-complete, both 
with respect to M. prob and Ai bel ; in HP, NP-complctcness was also shown with 
respect to Ai lp . Here we prove similar results for the language C E . In the case 
of M prob , this is not at all surprising, given Theorem 4.1 and the fact that the 
translation from C E to £® u causes only a linear blowup in the case of A4 P . 
However, we cannot get the result for J\A bel or J\4 poss from Theorem 4.1, since 
the translation causes an exponential blowup. Of course, in the case of M lp , no 
translation exists at all. Nevertheless, in all these cases, we can get NP-complctcness 
using techniques very much in the spirit of the linear programming techniques used 
in FHM. 

We define |/| to be the length of /, that is, the number of symbols required to 
write /, where each coefficient is counted as one symbol. Define ||/|| to be the 
length of the longest coefficient appearing in /, when written in binary. The size of 
a rational number |, denoted |||||, where a and b are relatively prime, is defined 
to be ||a|| + ||6||. 

The next theorems, helpful to establish the complexity of the decision procedures, 
show that the logic is not expressive enough to distinguish between infinite sample 
spaces and infinite ones; if a formula is satisfiable at all, it is satisfiablc in a 
(relatively small) finite structure. In other words, we could have restricted to 
structures with only finitely many worlds without loss of generality. We prove this 
result for M lp , M bel , and M poss ; it follows from Fagin et al. [1990, Theorem 2.4] 
(which shows that a formula in the language C® u is satisfiable in M prob iff it is 
satisfiable in a finite structure in A4 prob ) and Theorem 4.1 (which shows that every 
formula in C E is equivalent to a formula in C9 V for structures in Ai prob ) that the 
result holds for M prob as well. 

Theorem 6.1. Suppose that f e C E is satisfied in some structure in M lp . Then 
f is satisfied in a structure (W,V,tt) such that \W\ < |/| 2 , \V\ < |/|, /i(w) is 
a rational number such that \\fj,(w)\\ is 0(\f\ \\f\\ + |/| 2 log(|/|)) for every world 
w G W and fie?, and ir(w)(p) = false for every world w e W and every primitive 
proposition p not appearing in f. 

Proof. See Appendix A. 4. □ 

To prove a small-model theorem for belief functions (and possibility measures), we 
need a representation of belief functions that is particularly compact. Given a set W 
of worlds, a mass function m is a function from 2 W to [0, 1] such that m(0) = 0, and 
J2u<zw m (U) = 1 [Shafer 1976]. As is well known, in finite spaces, there is a one- 
to-one correspondence between belief functions and mass functions [Shafer 1976]. 
Given a mass function m, let Bcl m be the set function defined by setting Bel m (/7) = 
J2vcu m (V)- I* can b e shown that Bel m is a belief function (in particular, it 
satisfies B3). Conversely, given a belief function Bel, consider the set function mB e i 
defined by setting mBei(0) = 0, and tob o i(£0 = Bcl({7) — J2vcu m Bci(V). It can 
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be shown that TOBei is a mass function (in particular, WBei(C^) > for all U) and 
that Bel mBol = Bel. It easily follows that the mappings Bel tob i and m Bcl m 
give a one-to-one correspondence between belief function and mass functions. 

Theorem 6.2. Suppose that f £ C E is satisfied in some structure in Ai bel 
(resp., Ai poss ). Then f is satisfied in a structure (W,v,ir) such that \W\ < \ f\ 2 , v 
is a belief function (resp., possibility measure) whose corresponding mass function 
is positive on at most \ f\ subsets of W and the mass of each of these \f\ sets is 
a rational number of size 0{\f \ \\f\\ + |/| log(|/|)) ; and ir(w)(p) = false for every 
world w € W and every primitive proposition p not appearing in f. 

Proof. See Appendix A.4. □ 

Theorems 6.1 and 6.2 yield the following complexity result for the decision 
problem for C E . 

Theorem 6.3. The problem of deciding whether a formula in C E is satisfiable 
in M prob (resp., M lp , M bel , M poss ) is NP-complete. 

Proof. See Appendix A. 4. □ 
7. REASONING ABOUT GAMBLE INEQUALITIES 

Ineq presumes an oracle for all valid formulas about linear inequalities; as we 
said earlier, this oracle can be replaced by the complete axiomatization of linear 
inequalities provided in FHM. Similarly, E5 assumes an oracle for valid formulas 
about gamble inequalities. In this section, we provide an axiomatization that can 
replace that oracle. One of the axioms involves reasoning about linear inequalities 
over real-valued functions, so we axiomatize this as well. 

Let C 9 consist of all Boolean combinations of gamble inequalities 7 > c, where 
7 is a propositional gamble, as defined in Section 3, and c is an integer. As in 
Section 3.1, we write 71 < 72 as an abbreviation for 71—72 < 0, which is the 
form of gamble inequality used in axiom E5. We also use the abbreviations we 
defined in Section 3.1 for <, <, and =. However, we now take 71 > 72 to be an 
abbreviation for 71 > 72 A ^(71 < 72). The analogue of the conjunct 71 > 72 is 
not necessary when reasoning about likelihood or expectation, since likelihood and 
expectation terms are interpreted as real numbers, and thus are totally ordered. 
(For real numbers b\ and 62, < ^2) implies 61 > 62)- However, this is not the 
case for gamble expressions, which are interpreted as real- valued functions. 

We can provide a semantics for gamble formulas by considering structures M — 
(W, 7r) where If is a nonempty set of worlds and 7r associates with each world 
in IF a truth assignment on the primitive propositions. Let Ai 9 be the class all 
such structures. (Clearly, every structure in Ai prob , Ai lp , Ai bel , and J\4 poss can be 
interpreted as a structure in M. 9 by simply "forgetting" the uncertainty measure 
over the worlds. Note that IF is nonempty for such structures, since /x(IF) 7^ A*( ) 
for all the measures of uncertainty considered.) Then 

M \= 7 > c iff for all weW, MmM > c. 

Again, Boolean combinations are given semantics in the obvious way. 

We can characterize gamble formulas axiomatically as follows. As before, we 
have Taut and MP (although now we consider the instances of valid propositional 
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tautologies in the language C 9 ). Instead of Ineq, we have a similar axiom that 
captures reasoning about linear inequalities interpreted over real-valued functions 
with nonempty domains: 

IneqF. All instances in C 9 of valid formulas about linear inequalities over real- 
valued functions with nonempty domains. 

A formula about linear inequalities over real-valued functions is a Boolean combi- 
nation of formulas of the form a\V\ + ■ ■ ■ a n v n > c, where vi, . . . , v n are variables 
ranging over real- valued functions. This formula is valid if, for every domain X 
and every assignment for real- valued functions with domain X to v\,...,v n , the 
resulting inequality holds when c is interpreted as the constant function with domain 
X that always returns c € K and > is the pointwise ordering on functions. To 
get an instance of IneqF, we replace each function variable that occurs in a 
valid formula about linear inequalities by a propositional formula fi. (Again, each 
occurence of the function variable m must be replaced by the same propositional 
formula (fi.) As with Ineq, we can replace IneqF by a sound and complete 
axiomatization for Boolean combinations of linear inequalities over real-valued 
functions. We provide one such axiomatization at the end of this section. 10 We also 
consider the following axioms, which capture properties of indicator functions, such 
as: for any w g W, Xu(w)+X v (w) = X UuV (w) if UDV = 0, andlt/(w) < X v (w) 
if U C V. 

Gl. a((ip A V) V (ip A -i^)) = a(f A -0) + a(ip A -i^), 

G2. a(ip A V) + b(if A -i-ip) > 6 a(ip A ip) > 6 A b(ip A ~^ip) > 6 

G3. true = 1, 

G4. if — = if ip ^> ip is a, propositional tautology. 

Intuitively, Gl and G3 say that propositional formulas act like indicator functions, 
and G2 says that the > order is the pointwise order on gambles. Axiom G4 simply 
says that equivalent formulas yield the same indicator functions. Let AX 9 be the 
axiomatization {Taut, MP, IneqF, Gl, G2, G3, G4}. 

Theorem 7.1. AX 9 is a sound and complete axiomatization of C 9 with respect 
to M g . 

Proof. See Appendix A. 5. □ 

Finally, we consider the complexity of the decision procedure for C 9 . As we did 
in Section 6, let L\ be the restriction of C 9 to inequalities with integer coefficients. 
Perhaps not surprisingly, the logic for reasoning about gamble inequalities is NP- 
complete. 

Theorem 7.2. The problem of deciding whether a formula of C\ is satisfiable 
in Ai 9 is NP-complete. 



1(, In a preliminary version of this paper [Halpern and Pucclla 2002b], we mistakenly used an 
axiomatization that relied on Ineq. Ineq is inappropriate for reasoning about linear inequalities 
over real-valued functions because, intuitively, Ineq captures properties of inequalities where > is 
a linear order. However, the pointwise ordering on functions is only a partial order. Furthermore, 
we did not have axioms G2 and G3 in that version of the paper; they seem to be necessary. 
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PROOF. See Appendix A. 5. □ 

We now provide a sound and complete axiomatization for reasoning about linear 
inequalities over real- valued functions. As before, start with Taut and MP, and 
consider the following axioms: 

Fl. v - v > 6, 

F2. (aivi H h a k v k > c) ^ (aiUi H h a k v k + 0v k+ i > c), 

F3. (axVi + h a k v k > c) {a jl x jl + h a jk v jk > c), if j u . . . ,j k is a 

permutation of 1, . . . , k, 

F4. (a ± vi + h a k v k > c) A (a^vi + h a' k v k > c') 

=> (a 1 + a' 1 )v 1 H h (a k + a' k )v k > (c + c'), 

F5. {a\V\ + • • • + a k v k > c) <^ (daiwi + • • • + da k v k > dc), if d > 0, 
F6. (aivi + • • • + a k v k > c) ^> (ai«i + • • • + a k v k > d), if c > d. 

The axiomatization for Ineq for reasoning about linear inequalities over reals pre- 
sented in FHM is identical to this axiomatization, except that it includes one 
additional axiom: x > c V x < c. (Note that now c represents a real number, 
as opposed to c, which represents a constant real-valued function.) The absence of 
this axiom is not surprising; although > is a total order over the reals, it is only a 
partial order over real-valued functions. 

Let AX 7 be the axiomatization {Taut, MP, Fl, F2, F3, F4, F5, F6}. 

Theorem 7.3. AX^ is sound and complete for reasoning about formulas about 
linear inequalities over real-valued functions with nonempty domain. 

Proof. See Appendix A. 5. □ 

We can now replace axiom IneqF in AX 9 by F1-F6 (since AX 5 already has 
Taut and MP). Following the discussion above, this means that we replace the v's 
appearing in F1-F6 by propositional formulas ip's. Note that axiom Fl becomes 
redundant in AX 9 , since it becomes false > false, which follows from G2. 

The complexity of reasoning about linear inequalities over real- valued functions 
(with integer coefficients, following what was said in Section 6) is NP-complete, 
just like reasoning about linear inequalities over the reals. 

Theorem 7.4. The problem of deciding whether a formula about linear inequali- 
ties (with integer coefficients) is satisfiable over real-valued functions with nonempty 
domain is NP-complete. 

Proof. See Appendix A. 5. □ 
8. CONCLUSION 

The notion of expectation is critical in many areas, ranging from physics to decision 
theory (where much of modern theory of decision making under risk is based on 
the notion of maximizing expected utility [Savage 1954]), and theoretical computer 
science (where it arises, for example, when establishing the correctness and effi- 
ciency of randomized algorithms [Motwani and Raghavan 1995]). For the most 
part, expectation has been considered in the context of probability. However, it 
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has been considered for other representations of uncertainty. For example, various 
notions of decision making are based on taking expectations with respect to other 
representations of uncertainty [Schmeidler 1986; Walley 1991]. Indeed, it is possible 
to consider almost all decision rules as instances of a generalized expected utility, 
for different representations of uncertainty [Chu and Halpcrn 2003; 2004]. 

After reviewing characterizations of expectation functions with respect to various 
notions of uncertainty (and, in a few cases, providing characterizations when none 
existed) , we considered a propositional logic for reasoning about uncertainty. Such 
a logic should prove useful to reason about decision making with respect to various 
notions of uncertainty. Our logic is at least as expressive as the corresponding 
logic for reasoning about uncertainty for all representations we considered, and 
in some cases it is more expressive. For each representation of uncertainty, we 
provided a sound and complete axiomatization for the logic, and showed that the 
satisfiability problem is NP-complctc, as it is for reasoning about probabilibity, 
lower probabilities, and belief functions. Thus, the added expressiveness of being 
able to reason about expectation of sets of probability measures comes at no 
computational-complexity cost. Moreover, the axiomatization is, in some cases, 
much more elegant. 



A. PROOFS 

A.l Proofs for Section 2 

Proposition 2.6 defines the expectation of X in terms of the values {x\ 1 . . . , x n } that 
make up V(X). The following lemma, which turns out to be useful in a number 
of technical results, shows that we can use the same calculation for expectation for 
any set of values that includes V(X). The lemma holds for all the representations 
of uncertainty v considered in this paper. It uses only the fact that v{W) = 1 and 
v{0) = for all representations that we are considering. 

Lemma A.l. Let X be a gamble, let s\ < . . . < s m be reals such that V(X) C 
{si, . . . , s m }, and let v be either a probability measure, belief function, or possibility 
measure. Then E U (X) = si + (s 2 - s\)v(X > si) H h (s m - s m -i)v(X > s TO _i). 

Proof. Clearly, it suffices to show that the result holds for values such that s\ < 
. . . < s m . Indeed, if Sj = s i+1 for some i, then clearly the term (s i+1 — s i )i>(X > Sj) 
does not contribute to the sum. For a set S — {si, . . . , s m } such that S D V(X) 
and si < . . . < s m , define 

Ejj(X) = si + (s 2 - 8i)u(X > Sl ) + ... + (s m - 8m -i)u(X > s m _i). 

We proceed by induction on \S-V(X)\. If \S-V(X)\ = 0, then S = V(X). Observe 
that E U {X) is just E„^ X \x), so the base case is immediate. For the inductive step, 
suppose that S D V(X), \S— V(X) \ — k+ 1, and the claim holds for all sets S' such 
that S' 2 V(X) and \S' - V(X)\ = k. Choose seS- V(X) and let 5' = S - {s}. 
We show that E^(X) = E^'(X). There are three cases. 
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(1) s = min(S): Since s g V(X), we must have (X > s) = W. Thus, 

E S AX) 

= s+(si- s)v{X > s) + (s 2 - si)u(X > si) H h (s n - s n -i)v(X > s n _i) 

= s + (si - s) + (s 2 - si)v(X > si) H h (s„ - s„_i)^(X > s„_i) 

= si + (s 2 - Si)i/(X > si) H h (s„ - s„_i)i/(X > s„_i) 

= £f (X). 

(2) s = max(S'). Let s„ = max(S'). Since s V(X), (X > s n ) = 0. Thus, 

E S AX) 

= si + (s 2 - si)u(X > si) H h (s n - s„_i)i/(X > s„_i) + (s - s n )u(X > s n ) 

= si + (s 2 - si)i/(X > si) H h (s n - s n -i)v(X > s„_i) 

(3) 5 = {si , . .. ,Sk,s, Sk+i, • ■ • , s„} for some si, . . . , s„, such that s\ < . . . < Sk < 
s < Sk+i < ■ ■ ■ < s n . Since s £ V(X) and s > Sk, we have (X > s) = (X > Sk). 
Thus, 

(sfc+i - s k )n{X > Sk) = (sfe+i - > Sfc) + (s - s k )n{X > s k ) 

= (sfe+i - s)fi(X > s) + (s - s k )fi(X > s k ). 

It is immediate that Ejj(X) = Ef(X). 
This completes the proof of the inductive step. □ 

Lemma A. 2. The functions Eq c \ and Epi aus satisfy (6). 

Proof. Suppose that X and Y are comonotonic gambles. We claim that there 
exist pairwise disjoint sets U\, . . . , U n and reals a\, . . . , a n , b\, . . . , b n such that 

(a) X = a 1 X Ul H h a n X Un , 

(b) Y = hX^ + ■ ■ ■ + b n X Un , 

(c) oi < . . . < a n , and 

(d) &i < ... < b n . 

To see this, suppose that V(X) = {a[, . . . ,a' m }, where a\ < ... < a' m , and 
V(Y) = {b[, . . . , b' m ,}, where b[ < . . . < b' m ,. Define U[ = X" 1 ^) for i = 1, . . . , to, 
and C/j' = F" 1 ^) for j = 1, . . . , to'. Then clearly (a) X = c^X^ + • • • + a' m X UL , 
(b) y = b\Xjjn + ■ ■ ■ + b' m ,Xu" ( , (c) the sets [/{,..., J/^ are pairwise disjoint, (d) 

the sets U[',...,U^, are pairwise disjoint, and (e) W = U™^/ = U^t/f. Let 
Vij = f/j' n U". Note that if and V^/j' are both nonempty and i < i' , then 
j < /■ For suppose not; then i < i' and j > j'. Thus, if w £ Vij and w' e Vj/j', 
then - X(w')){Y(w) - Y(w')) = {a[ - o<,)(6j - < 0, contradicting the 

comonotonicity of X and F. It follows that we can take the claimed sets Ui, . . . , U n 
to be the nonempty sets Vij ordered lexicographically (so that if Uk = Vij, Uk> = 
Vi'j>, and k < k' , then either i < i' or i = i' and j < j'). Moreover, if Uk = Vij, 
take a k = a- and b k = b'j. It is clear that these choices have the required properties. 

For this choice of U\, . . . , U n , it follows that X + Y = (ai + bi)X Ul + • • • + (a„ + 
b n )Xu n , with ai + b\ < . . . < a n + b n . By construction, we have V(X + Y) = 

Journal of the ACM, Vol. V, No. N, February 2008. 



Characterizing and Reasoning about Probabilistic and Non-Probabilistic Expectation • 23 



{ai + bi, . . . , a n + b n }. By Lemma A.l, we have the following, where v is cither Bel 
or Plaus: 

E V {X + Y) 

= (ai + &i) + (a 2 + b 2 -a 1 - h)i>(X + Y > ai + 61) + • • • + 

)v(X + Y> a„_i + &„_i) 
= (ai + &i) + (a 2 + 6 2 - ai - 6i)^(Z7 2 U ... U [/„) + ••• + 

(a„ + 6„ - a„_i - 6„_i)i/(J7„) 
= ax + (a 2 - a-t)v(U 2 U . . . U £/„) H h (a„ - a„-i)^(C/„)+ 

6l + O2 - &l)^(C/ 2 U . . . U U n ) + ■ ■ ■ + (b n - fcn-iME/n) 

= ai + (a 2 - a 1 )v(X > ai) H h (a„ - a n _i)^(X > a„_i)+ 

61 + (&2 - 6i)i/(y > 61) + • • • + {b n - b n -x)v{Y > 6„_i) 
= + 

where the last equality follows from Lemma A. 1 and the fact that V(X) = {ai , . . . ,a n } 
and V(Y) = {b u ...,b n }. □ 

Proposition 2.8. The function E^ei is superadditive, positively affinely homo- 
geneous, monotone, and satisfies (5) and (6). 

Proof. The fact that i?Boi is superadditive, positively affinely homogeneous, 
and monotone follows immediately from Theorem 2.5 and Proposition 2.3. The 
fact that i?Bei satisfies (5) follows essentially from property B3 of belief functions 
and Proposition 2.6. First, it is easily checked that for gambles X and Y, X V Y > 
x = (X > x) U (Y > x) and X A Y > x = (X > x) n (Y > x). Consider the gamble 
X X V . . .VX n . Let S = V(Xi)U.. .UV(X n ) = {si, . . . ,s m }, with si < . . . < s m . Let 
so be an arbitrary real less than every number in S. Clearly, V(Xi V ... V X n ) C S. 
Moreover, for every subset 7 C {1, . . . , n}, V(A ie iXi) C S. By Proposition 2.6 and 
Lemma A.l, we have: 

£ B ci(A 1 V...VA„) 
= s i + E™=i( s fc - Sfe-i)Bel(Xi V...VI„> s fc _i) 

= Sl Bel(Xi V . . . V X n > s ) + Y.k=ii s k - s fe -i)Bel(Xi V...VI„> s k -i) 
= siBel(Xi > s U . . . U X n > s )+ 

Efcli( s fc _ s fe _i)Bel(Xi > s fe _i U...UI„> s fe _i) 
> ^iEr=iE/c { i,...,„},|/|= 4 (-l) i+1 Bcl(n je/ ^ >s )+ 

Er=i( s fe - s k-i) ELi E/c { i....,„}.|/|= 4 (- 1 ) 4+lBcl (n je /A, > Sk -i) 

= E7=iEic {h ...,n }M a^Y + HsiBel(n jeI X 3 > s )+ 

Er=i( s fe _ Sfc-i)Bci(n, e/ x,- > s fe _i)) 

= ELi E/c{i,...,„}.|/|= 4 (- 1 ) l+1 ( s i + EfcliK - Sk-i)Bel{A jeI Xj > s k -i)) 

= ElLl E/C { l,... ; n},|/|=i(-l) i+1 ^Bel(A j e/X j ). 

Finally, the fact that i?Bci satisfies (6) follows from Lemma A. 2. □ 

The following property turns out to be useful in various proofs involving expec- 
tation for belief functions. 

Lemma A. 3. If E is an expectation function that satisfies (6) and positive affine 
homogeneity, then it satisfies the following property on indicator functions: 

If Ui 2 U2 2 ■ • • 2 U n and ai, . . . , a n > 0, , , 

then E{aiX Vl +■■■ + a n X Un ) = a l E{X Ul ) + ■■■ + a n E(X Un ). [ ' 
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Proof. Define Sk = a\Xu 1 + ■ ■ ■ + cikXu k , for k = 1, . . . , n. Since cij > for 
i = 1, ... ,n, it is not hard to show that Sk and a,k+iXu k+1 are comonotonic for all 
k. For if Sk(w) > Sk(w'), since U\ D . . . 2 £4, there must be some j < k such that 
w e C/j and io' ^ Since 3 £4+i, it must be the case that w' U k +i- Hence 
a k+\Xu k+1 {w') = and a k+ iX Uk+1 (w) > 0. Thus, we have comonotonicity. Since 
E satisfies (6), it follows that 

E(a 1 X Ul H h a n X Un ) 

= E(S n ) = E(S n -! + a n X Un ) = E(S n -!) + E(a n X Un ) = ... 
= EimXuJ + ■ ■ ■ + E(a n X Un ) 

The result is now immediate, since E satisfies positive homogeneity. □ 

Theorem 2.9. Suppose that E is an expectation function that is positively affinely 
homogeneous, monotone, and satisfies (5) and (6). Then there is a (necessarily 
unique) belief function Bel such that E = E^ei- 

Proof. Define Bel(£7) = E(Xjj). Just as in the case of probability, it follows 
from positive affine homogeneity and monotonicity that Bel(0) = 0, Bel(VK) = 1, 
and < Bel(U) < 1 for all U C W. By (5) (specialized to indicator functions), it 
follows that Bel satisfies B3. Thus, Bel is a belief function. Now if X is a gamble 
such that V(X) = {xi, . . . , x n } and X\ < x 2 < ■ ■ ■ < x n , then it is easy to check 
that 

X = x\X w + (x 2 - xi)X x > Xl H 1- {x n - x n -i)X x > Xn -i- 

Clearly W D (X > x{) D . . . D (X > x„_i). Thus, by Lemma A.3, 

E(X) - x x E{X w ) + (x 2 - Xl )E(X x>Xl ) + ■■■ + (*„- x^EiXxy^) 

= x\ + (x 2 - xi)Bel(X > xi) + \-{x n — x n -i)Bel(X > x n -\) 

= E Bcl (X). 

For uniqueness, observe that if Eb c i = -EbcI'j then Be\(U) = E-Q e \{Xu) = 
E B er{Xu) = Bel'(U) for all U C W. □ 

Proposition 2.12. The function Ep oss is positively affinely homogeneous, mono- 
tone, and satisfies (6) and (7). 

Proof. Recall from Section 2.4 that a possibility measure is just a plausibil- 
ity function. Therefore, by Theorem 2.5 and Proposition 2.7, we have -Ep oss = 
E-p Bc] , where Bel is the belief function whose corresponding plausibility function 
is Poss. By Proposition 2.3, we immediately have that -Ep OS s is positively affinely 
homogeneous, and monotone. By Lemma A. 2, we have that Ep oss satisfies (6). 
Showing that -Ep oss satsifies (7) is straightforward: Ep oss (X Ui u i ) — Poss(Ui Ui) = 
maxi Poss(£/i) = max, £?p oss (AVJ. □ 

Theorem 2.13. Suppose that E is an expectation function that is positively 
affinely homogeneous, monotone, and satisfies (6) and (7). Then there is a (neces- 
sarily unique ) possibility measure Poss such that E = Ep oss . 

PROOF. Define Poss(C7) = E{Xjj). Just as in the case of probability and be- 
lief functions, it follows from positive affine homogeneity and monotonicity that 
Poss(0) = 0, Poss(W/) = 1, and < Poss(?7) < 1 for all U C W. By (7), 
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it follows that Poss satisfies Poss3. Thus, Poss is a possibility measure. The 
proof that E = Ep oss is the same as that of Theorem 2.9, which is not surprising 
since Poss is a plausibility function. More precisely, let X be a gamble such that 
V(X) = {xi, . . . , x n } with x\ < . . . < x n , and write X as xiXw + (x 2 — xi)Xx> Xl + 

• • • + (x n — x n -i)Xx> Xn - 1 - Since W ^ (X > xi) D . . . D (X > ir n _i), we can 
apply Lemma A. 3 to get 

E(X) = Xl E{X w ) + (x 2 - Xl )E(X x>Xl ) + ■ ■ ■ + (x n - a;„_ 1 )i;(X x>Xn _ 1 ) 
= x x + (x 2 - xi)Poss(X > xi) H \-(x n - x„_i)Poss(X > a; n _i) 

= -Eposs(^)- 

□ 

A. 2 Proofs for Section 4 

The following transformations on formulas of C E will be used in the proofs of 
Theorems 4.1, 5.1, 5.3, and 5.4. We prove here that these transformations preserve 
satisfiability of the formulas, with respect to the appropriate structures. 

First, define for a formula / of C E , the transformation f Tl inductively on the 
structure of/, taking (a 1 e(7 1 ) + - + a„e(7„) > b) Tl to be + - • ■+<„ > b, where ti is 

obtained from a, and 7, = c M <^ M H c k ,Wk,i as aiC M e(</? M ) H h aiC k ^e(tp k ,i)- 

We define (A A / 2 ) Tl and (^A) Tl as A /J 1 and ^(Z^ 1 ), respectively. 

Lemma A. 4. If M e 7W pro6 , f/ien M \= f if and only if M \= f T K 

Proof. We proceed by induction on the structure of /. For the base case, 

M |= Oie(7i) H > b 

iff a 1 E ll {X 11 ) + • •• > b 

iff diE^c^X^ i]m + • • • + c fc ,!l bw]M ) + •••>& 

iff aiCi,i^(X [vi l]M ) + • • • + aic fe ,i^(X IwM ] M ) + ■ • • > b 

iff M |= aic M e(</? M ) H h aic M e(</? fca ) H > 6. 

The inductive cases are immediate. □ 

The second transformation is a bit more complicated. As before, we define a 
transformation taking a formula / of C E to a formula f T2 by induction on the 
structure of /. Intuitively, we translate every expectation term 6(7) appearing 
in / into an expectation term of the form given by Proposition 2.6, namely d + 
(di — do)e(ipi) + . . . + (d m — d m -i)e(xp m ) for formulas ipi, . . . , ip m . As before, take 
(/1 A f 2 ) T2 and (-./i) T2 to be A /J 2 and -.(Z^), respectively. Take (a ie ( 7l ) + 

• • • + a„e(7„) > 6) T2 to be fi + • • • + t n > b, where ti is obtained from and 
7i = ci^ipi.i + • • • + c k ,i<Pk.i as follows. Let pi, . . . be the primitive propositions 
that appear in /. Let an atom over pi,...,p N be a formula of the form qi A 
. . . A qpf, where qi is either pi or ^pi. There are clearly 2 N atoms over pi, . . . ,pn- 
Let 5i,...,5 2 n be an arbitrary ordering of these atoms. It is easy to see that 
atoms are pairwise disjoint. It is also easy to see that any formula over pi,. .. ,Pn 
can be written in a unique way as a disjunction of atoms. Using these atoms, 
we construct a gamble 7- equivalent to 7^ as follows. For j e {1, ...,2^}, let 
c j = E{; : Si => Vl , t is a prop, tautology} C M ■ lt is straightforward to check that 7l = 
^jj—iCjSj. Let do,..-, d m be the distinct elements of {cj}j e {i t „^ 2 Ny, with do < 
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... < d m . For j g {1,...,™}, let = V; e {i 2 N },ci>d 3 Note tnat is 

logically equivalent to true; moreover, tpj+i => rpj is a propositional tautology for 
all j g {0, . . . , m— 1}. Finally, let 7? = rf + (di — do)V>i + ' ' , + (4 _ 4i-i)^m' One 
can check that 7^ and 7^ are equivalent gambles. Indeed, 7^ is provably equivalent 

to d (Ez=i 5i) + (di - do)(Ec 1 >d 1 + • • • + ( d m - d m-i)(E C! >d„, Distributing 
the coefficients and putting like terms together, we see that the coefficient of Si 
is just do + (di — do) + . . . + (d re — d rt -\) = d rt , where rg — max{r : q > d r }. 
By definition of d\, . . . , d m , d re — a, and therefore 7$ and 7- are equivalent. Note 
that, by Lemma A. 3, if E is an expectation function that satisfies comonotonicity 
and positive homogeneity, then E(Xy.) = d\ + (di — d )E(X^ 1 j M ) + • • • + (d m — 
d m -i)E(X^ m j M ). Let ti be ajd + a»(di - do)e(^i) H 1- ai(d m - d m _i)e(V> m )- 

Lemma A. 5. IfM g A4 pro6 UA4 6e 'u.M poss , tften M |= / i/and only if M \= f T \ 

PROOF. We proceed by induction on the structure of /, for M G M bel ; the result 
follows for structures in M prob and M poss , since these can be viewed as structures 
in M bel . For the base case, we have 

M |= 0x6(7!) H a n e(j n ) > b 

iff ai-EBeiP^yi) H a„£;Bci(^7„) > b 

iff ai£; Bc i(^ 7 ;) H h a^Bei^J > & 

iff ai2?Bei(do,i + (di,i — d ,i)^[^i,i]M + ' ' ' + (4n,i _ ( ^"»i-i>i)^[V'm 1 ,i]M)+ 
• • • + a„_E Bo i(rfo,n + (di,„ - do,n)^[v. lin ] M + h 

iff aid ,i + fli(di,i - d ,i)^Bei(^[v.i,i] M ) ^ ^ 

«l(d mii i — d TOl _i i i)£JBel(^[V' mi ,i]M) + ' ' • + 

a n do,n + «l(dl,„ — d 0l „)^Bel(^[V>n,i]M) + ' ' ' + 
a n (dm n ,n — dm n -l,n)EBcl(Xl 1 p mn n J M ) > b 

iff M |= oid ,i + oi(di,i - d ,i) e (V'i,i) ^ ^ a i(d m .i - d m -i,i) e ( < Pm,i) H I- 

and ,„ + a„(di,„ - do, n )e(V>i,„) H a «(d 

The fact that we can distribute the expectation £b c i of the gamble into a sum of 
expectation of indicator functions follows from comonotonicity, using Lemma A. 3. 
The inductive cases are immediate. □ 

Theorem 4.1. C E and £® u are equivalent in expressive power with respect to 
M proh , M bel , and M poss . C E is strictly more expressive than Cfi u with respect to 
M lp . 

Proof. The proof follows the lines laid out in Section 4. First, we show that 
C E is at least as expressive as C QU with respect to M prob , M bel ,M lp , and M poss . 
Formally, we show that every formula / of C® u is equivalent to the formula f T g C E 
that results by replacing £(<p) by e(ip). Define f T by induction on the structure 
of /, taking (aii(ipi) + ■ ■ ■ + a n £(ip n ) > b) T to be aie(v?i) + ■ ■ ■ + a n £(ip n ) > b, 
(/1 A f 2 ) T to be f[ A /J, and (^/i) T to be -(/ T ). 

It suffices to show that for all M in M prob , M bel ,M lp , or M poss , we have M \= f 
if and only if M \= f T . First, note if v is a probability measure, belief function, 
or set of probability measures, then E l/ (X U ) = v{U), where X v is the indicator 
function of U. Let M be an arbitrary structure in M prob , M bel , M lp , or M poss , 
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with associated measure of uncertainty jj,. Thus, if v is the measure associated 
with structure M, we have that ^([^Jm) = E v (\X^ m \m)- (If v is the set V or 
probability measures, we take E v = E v .) The result now follows immediately by a 
straightforward induction on the structure of /. 

We next show that CP U is as expressive as C E with respect to M prob , M bel , 
and A4 poss . Let C E be the sublanguage of C E where the expectation operator e 
is applied only to propositional formulas, as opposed to arbitrary gambles. It is 
immediate from the construction in the previous paragraph that if / £ C® u , then 
f T £ C E . Moreover, it is easy to see that every formula /' £ C E is of the form f T 
(where / is the result of replacing all occurrences of e(ip) in /' by Since we 

showed above that / is equivalent to f T , to prove that C® u is as expressive to C E 
with respect to A4 P , A4 bel , and A4 poss , it suffices to show that every formula in 
C E is equivalent to a formula in C E ' in structures in M prob U M bel U M poss . But 
this is immediate from Lemma A. 5, since the formula f T2 £ C E . 

Finally, we show that C E is strictly more expressive than C® u with respect 
to M lp . To establish this, it is sufficient to exhibit two structures in M lp that 
satisfy the same formulas in £® u , but can be distinguished by a formula / in C E . 
(This means that / in C E cannot be equivalent to any formula in C® u .) We use 
a variant of Example 2.11. Consider the two M lp structures Mi = (W, Vi,ir) 
and M 2 = (W,V2,k), where W — {wi,W2,W3}, 7r is such that p is true at w\, 
both p and q are true at w 2 , and neither p nor q is true at W3, and the sets of 
probability measures V\ and V2 are given as follows. We can describe a probability 
measure on W by a tuple (ai,a 2 ,a 3 ), where a, gives the probability at Wi. Define 
V\ = {(1/3, 2/3, 0), (0, 1/3, 2/3), (2/3, 0, 1/3)}, and P 2 =?!U {(1/3, 0, /2, 3)}. It 
is easy to check that (Vi)* and (V2)* are both on singleton subsets of W and 
1/3 on doubleton subsets. Hence, ("Pi)* = ("^2)*- Therefore, no formula involving 
only lower probability can distinguish these two structures, and Mi and M 2 satisfy 
the same formulas of £® u . Now, consider the gamble p + q. It is easy to see 
that \p + q$M! = {p + q$M 2 is the random variable X defined by X(wi) = 1, 
X{w2) = 2, and X(w%) = 0. It is not hard to check that E Vi (X) = 2/3, and 
E V2 (X) = 1/3. Hence, Mi |= e(p + q) > 1/2, and M 2 \= e(p + q) < 1/2, so that 
M 2 h ->e(p + q)> 1/2. □ 

A. 3 Proofs for Section 5 

The proofs of Theorems 5.1-5.4 use an approach similar to the one taken in FHM. 
We first need some definitions. We say a formula a is consistent with an axiom 
system AX (or simply AX-consistent) if is not provable from AX. To show 
that AX is a complete axiomatization with respect to some class of structure A4, 
we must show that every formula that is valid in every structure in M is provable in 
AX. This is equivalent to showing that every AX-consistent formula a is satisfiable 
in M. 

The proofs of Theorems 5.1-5.4 are all structured as follows. Soundness is 
straightforward in all cases. Completeness is obtained by showing that a consistent 
formula / is satisfiable in the appropriate set of structures M.. More specifically, 
assume that formula / is not satisfiable in a structure in M; we must show that 
/ is inconsistent. We first reduce / to a canonical form. Let gi V . . . V g r be 
a disjunctive normal form expression for / (where each gi is a conjunction of 
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expectation inequalities and their negations). Using propositional reasoning, we can 
show that / is provably equivalent to this disjunction. Since / is unsatisfiable, each 
gi must also be unsatisfiable. Thus, it is sufficient to show that any unsatisfiable 
conjunction of expectation inequalities and their negations is inconsistent. Let 
/ be such a formula. To show that it is inconsistent, we essentially construct a 
system of inequalities / from / by replacing every term e(ji) in / by a variable Xi, 
with the property that / is satisfiable over structures in M if and only if / has a 
solution over the reals. Since / is unsatisfiable, / has no solution, so that ->/ must 
be an instance of Ineq. (That / has no solution means that / is not satisfiable 
as a formula about linear inequalities, so that is a valid formula about linear 
inequalities.) Therefore, is provable, and / is inconsistent. The details of how 
to construct / differ for each representation of uncertainty. 

Theorem 5.1. AX. prob is a sound and complete axiomatization of C E with 
respect to M prob . 

PROOF. Soundness is straightforward. For completeness, we proceed as above. 
Without loss of generality, assume that / is a conjunction of expectation inequalities 
and their negations. Using axioms El and E2, we can convert / into the equivalent 
formula f Tl (Lemma A. 4) where e is applied only to propositional formulas. For 
every propositional formula ip in f Tl , <p is equivalent to Vj =1 5 i:j , where 5^, . . . ,S ik 
are the atoms over the propositions in / such that Si j ip for all 1 < j < k. 
Since A <5 i( ) is a propositional tautology for all j ^ I, <p = S il + ■ ■ ■ + S ik is a 

valid formula about propositional gamble inequalities (see Section 7), and axiom E5 
yields e(ip) = e(Si 1 + ■ ■ ■ + Si k ). This means that we can find a formula /' provably 
equivalent to f Tl , where /' is formed by replacing each term ae(ip) of f Tl by the 
sum ae(5 il ) + ■ ■ - + ae(S ik ), and then collecting like terms. Let /" be obtained from 
/' by adding as conjuncts to /' all the expectation inequality formulas e(6j) > 0, 

for 1 < j < 2 N , e((5i) + • • • + e(<5 2 «) > 1, and -e(5i) e(J 2 «) > -1 (which 

together essentially say that the sum of the probabilities of the atoms is 1). It is 
not hard to see that these formulas are provable, hence /" is provably equivalent 
to /', and hence to /. We therefore only have to show that /" is satisfiable. 

The negation of an expectation inequality aie(7i) + • • • + a„e(7„) > b can be 
written — aie(7i) — • • • — a n e(7„) > —b. Thus, without loss of generality, we can 
assume that /" is the conjunction of the formulas 

e(<5x) H h e(<5 2 «) > 1 

-e(<5i) e(S 2N ) > -1 

e(5i) > 

e(S 2N ) > 

ai,ie(<5i) H h o li2 Jve(5 2 Jv) > h 

a r ,ie(S\) + h a r 2 jve(<5 2 jv) > b r 

-a' ltl e(6i) a' 12N e(5 2 N) > b[ 
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~ a ' s ,i e ( 6 i) a,' a>2N e(6 2 n) > b' s . 

Consider the following system of inequations, obtained by replacing e(6i) by the 
variable x^. 

Xi H + x 2 n > 1 

—x\ — ■ ■ ■ — x 2 n > —1 
x\ > 

X 2 N > 

01,1X1 + • • • + ai 2 NX 2 N > b\ 

a r .\X\ + • • • + a v 2 NX 2 N > b r 
—a^ ± Xi — ■ ■ ■ — a! x 2 nX 2 n > b' x 

- a 's,i x i a' s 2N x 2 N > b' s . 

Clearly if /" is satisfiablc, say in a structure M with associated probability measure 
\x, then the system is satisfiable, by taking Xi = /u([5j]m)- Conversely, if the system 
of inequations has a solution, then /" is satisfied in a structure M with associated 
probability measure \i such that Xi = ^([^Jm)- 

Returning to the main argument, suppose by way of contradiction, that / is not 
satisfiable. Then this system of inequations has no solution. It follows that -■/" is 
an instance of the axiom Ineq. Since /" is provably equivalent to /, it follows that 
is provable, so that / is inconsistent, a contradiction. □ 

The proofs of Theorems 5.2, 5.3, and 5.4 require some additional terminology. 
Let / be a formula of C E , and let p\, . . . ,pjy be the primitive propositions that 
appear in /. Observe that there are 2 2 inequivalent propositional formulas over 
Pi, ■ . ■ ,Pn- The argument goes as follows. Recall the notion of an atom over 
pi, . . . ,pn, introduced before Lemma A. 5. It is easy to see that any formula over 
pi,. . . ,Pn can be written in a unique way as a disjunction of atoms. There are 2 2 
such disjunctions, so the claim follows. Let pi,. . . ,/o 22 « be some canonical listing 
of the inequivalent formulas over p\,...,pn- Without loss of generality, we assume 
that pi is equivalent to true, and p 22 N is equivalent to false. Following FHM, we 

call these formulas pi, i — 1, . . . , 2 2 ™ regions. 

Theorem 5.2. AX !p is a sound and complete axiomatization of C E with respect 
to M lp . 

PROOF. Soundness is straightforward. For completeness, we proceed as above. 
Again, without loss of generality, assume that / is a conjunction of expectation 
inequalities and their negations. 
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The first step of the proof is to find a formula /' provably equivalent to /, where 
the gambles in /' are expressed in terms of atoms Si,... , 8 2 n . As observed above, 
every propositional formula ip in / is equivalent to some region pi, 1 < i < 2 , 
which is of the form V^ =1 ^ , where S^ , . . . , 8i k are the atoms over the propositions 
in / such that 5 ij ip for all 1 < j < k. Since Si j A 5 it false is a propositional 
tautology for all j ^ I, tp = 6^+- ■ -+Si k is valid. It easily follows that a propositional 

gamble aipi H h a n p n is equal to a propositional gamble of the form a[Si H h 

a' 2N 8 2 N . By axiom E5, e(ai<pi + • • • + a n ip n ) = e^Si + • • • + a' 2N S 2 N) is provable. 
This means we can find a formula /' provably equivalent to /, where each term ae(7) 
of / is replaced by a term ae(a[Si + • • • + a' 2N 8 2 N). In fact, the following arguments 
shows that, without loss of generality, we can take the o-s to be nonnegative. Given 
a gamble a^Si + . . . + a' 2N 5 2 N , let b — min 1<i<2 w (a^). We can easily show that 
(a[ + b)Si + . . . + {a' 2N + b)S 2 N —b — a[Si + . . . + a' 2N 5 2 N is a valid gamble equality 
Thus, every expectation inequality formula cie(-fi) + . . . + Cke(jk) > d in /' is 
provably equivalent to a formula of the form cie("f[) + C1&1 + . . . + Cke("fj ) + Ckbk > d, 
which in turn is provably equivalent to cie(j' 1 ) + . . . + Cke{^' k ) > d—cibi — . . . — c^b^. 
Thus, without loss of generality, we can take the coefficients of the gambles in /' 
to be nonnegative. 

The next step of the proof is to derive a finite system of inequations / corre- 
sponding to /' such that /' is satisfiable if and only / has a solution. Suppose that 
we have found such a formula / and that /' is unsatisfiable. Then / has no solution. 
Thus, the formula ->/' is an instance of Ineq. Since /' is provably equivalent to 
/, -if is provable, and thus / is inconsistent, a contradiction. Therefore, /', and 
hence /, is satisfiable. The remainder of the proof consists of coming up with /, 
and showing that it has a solution if and only if /' is satisfiable. 

We would like / to be a system of inequalities that yields a solution that can 
be used to construct a lower expectation function that satisfies /'. We can force 
a solution to / to be a lower expectation function by adding to / inequalities 
corresponding to all the instances of axioms E6-E8. Unfortunately, there are 
infinitely many such instances. The aim now is therefore to derive a finite set of 
instances of E6-E8 that is sufficient to constrain a solution to / to be a lower 
expectation function. 

To do this, let 71, . . . ,7 n be the propositional gambles 7 such that e(j) appears 
in /', together with the propositional gambles false and true (if they do not already 
appear in /'). For ease of exposition, take 7„_i = false and j n — true. As we saw 
earlier, each 7^ is provably equivalent to a formula of the form ai ! i<5i + - • - + aj 2 nS 2 n, 
where Si, ... , S 2 n are the atoms over the primitive propositions appearing in /, and 
o-i.j > 0. We now construct, for every propositional gamble 7i (1 < i < n — 1), a 
finite set Bi of vectors. (We do not need a vector for the gamble 7„ = true.) We 
give the construction of B\, and then describe the minor modifications needed to 
construct Bi for i = 2, . . . , n — 1. We then show how to use these sets to identify a 
finite set of instances of E6-E8. 

Let Ai be the (n — 1) x 2 N matrix of real numbers whose ith row consists of the 
coefficients of Si, ... , 5 2 n in 7,+i, i = 1, . . . ,n — 1. Let B[ be the set of vectors 
b = (b 2 , . . . , b n ) such that b 2 , . . . , 6„_i > (b n can be negative) and 



bAi < (01,1, . . . ,a li2 Af). 
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It is easy to see that B[ is a closed convex set: it is clearly closed, and if b\, 62 € B[, 
then so is ab\ + (1 — a)b 2 , for all a e [0, 1]. Thus, for each vector y = (y\, . . . , y n -\) 
such that yi , . . . , y„_2 > 0, there exists a,b y £ B[ such that b y -y is maximal (where 
• is the inner product). It is a consequence of the Krein-Milman Theorem (see 
Rudin [1991], for instance) that the set of such b y is a finite subset Bi of B[. 

We use the set B\ to derive a finite number of instances of E6-E8 as follows. 
Note that if b = (62, • ■ • , b n ) satisfies (9), then 6272 + • • • + b n j n < 71 is a valid 
formula about gamble inequalities. Therefore, by E5, e(&272 + ■ ■ ■ + b n j n ) < e(7i). 

By applying E6, E7 and E8, we can derive 626(72) H i> n _ie(7 n _i) + b n < e(7i). 

Let be the conjunction of the instances of axioms E6, E7, and E8 that are used 
to perform this derivation. Let fi be the conjunction of for all b e B x . 

This process defines a set _Bi of vectors, and from these a formula f\. Repeat 
this process for the gambles 72, • • ■ , 7n-i, by interchanging the role of 71 and 7$, 
for 2 < i < n — 1. After doing this for all gambles, we obtain sets £?i, . . . , £?„_i of 
vectors, and formulas /1, . . . , f n -i- 

Let /" be the conjunction of /1, /„_i, /', e(7 n _i) > 0, -e(7„_i) > 0, 
e (7n) ^ 1) an( i ~ e (7n) > ~~ 1 (that is, e(false) = and e{true) = 1, since 7„_i = 
/aise and j n — true, by assumption). Let / be the conjunction of inequalities 
obtained by replacing every instance of a term of the form e(j) in /" by the variable 
x~. Note that, besides e(7i), . . . , e(7„), there are other terms of the form e(j) 
that arise in /1, . . . , the gambles 7 in these terms are linear combinations of 

71, . . . , 7„. We then obtain a system of inequalities over the variables x 1 . We now 
show that / is our required system of inequalities, that is, /' is satisfiable if and 
only if / has a solution. 

It is straightforward to show that if /' is satisfiable, then / has a solution. If 
/' is satisfiable, then there exists a lower probability structure (W,V,Tr) such that 
(WjVjir) \= /', and hence {W,V,-n:) |= /" (since the instances of E6-E8 are valid 
in lower probability structures). Clearly, taking x 7 = E v (^j^m) gives a solution 
to /. 

The interesting direction is showing that if / has a solution, then /' is satisfiable 
in A4 lp . Suppose that / has a solution in which a; 7l , . . . , x ln taken on values 
x\,..., 2;* , respectively. (Note that by the construction of /, we must have x* _ 1 = 
and x* n = 1.) Take W = {6\, . . . ,S 2 n}, and let n(Si)(p) = true if and only if 
Si => p is a propositional tautology. We need to show that there exists a set of 
probability measures V such that (W,P,tt) |= /'. To do this, we start with the 
solution to /, which intuitively gives us a lower expectation function defined on 
a subset of gambles (those that appear in /), and show that it can be extended 
to a lower expectation function defined on all gambles. This lower expectation 
function will give us the set V of probability measures necessary for satisfiability. 
More precisely, corresponding to the propositional gambles 71 , . . . , 7„ appearing in / 
(along with false and true, as described above), let Xi be the gamble corresponding 
to ji = di t i5i + . . . + ai2 N ^2 N defined on W by Xi(5j) — aij, for all 1 < j ' < 2 N . 
Define the function P_* on {X\, . . . , X n } by P*(Xi) — x*. Our goal is to extend P* 
to a lower expectation function E* defined on all gambles, such that E* (Y) = P* (Y) 
for Y e{X 1 ,...,X n }. 
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The first thing we have to check is that P* is a potential candidate to be a partial 
lower expectation function. This is made precise by Walley's [1991, p. 72] notion of 
coherence. A function P defined on a set {X\, . . . ,X n } of gambles is coherent if 
and only if for all reals b\, . . . , b n > and i* e {1, . . . , n}, we have 11 



sup 



(£b j (X j -P(X j )))-b i .(X i .-P(X i .)) 



(w) } > 0. 



(10) 



If E is a lower expectation function (that is, if E = E_ v for some set V of probability 
measures) then (10) holds (with P replaced by E). To see this, first note that for 
any gambles Y, Yi, . . . ,Y n and nonnegative reals b, b\, . . . , b n , by Proposition 2.3, 

E{b{Y - E~{Y))) = 0, and £(&i(Yi - Ep\)) + ■■■ + E(Y n - E{Y^)) > 0. Now 
suppose that 



sup 



(^(Yj-EiY^-bEiY-EiY)) 

3=1 



c < 0. 



Then YTj=i h A Y 3 - E ( Y j)) < H E ( Y - E ( Y )) + ~ c - Thu « 

n 

£(E b iVi E ^))) < E ( b ( Y E ( Y )) + 5 ) = E ( b ( Y E ( Y ))) + c=c<0. 

3=1 

But this is a contradiction. It follows that (10) holds for E. 

This shows that coherence, that is, (10), is a necessary condition for P to be 
extendible to a lower expectation. Walley's Natural Extension Theorem, which we 
now state, shows that it is sufficient as well. 

Theorem A. 6. [Walley 1991, p. 123] Suppose that P is a coherent real-valued 
function defined on a set Q of gambles on W . Define the natural extension E of P 
as 

m 

E(Y) = sup{6 : Y-b>J2 *j( Y j - P( Y j)),m > 0, Yj G G, Xj >0,be R}. 

3 = 1 

Then E is a lower expectation function (that is, E = E v for some set V of 
probability measures onW) and E agrees with P on the gambles in Q. 

It follows from Theorem A. 6 that to show that P* can be extended to a lower 
expectation, it suffices to show that it is coherent. This is done in the next lemma. 



Lemma A. 7. The function P* is coherent on {X\, . . . ,X n }. 



^Walley has an apparently stronger requirement, namely, that for all Yi , . . . , Y m C {X\ , . . . , X n } 
and all reals b u . . . , b m , we have sup wew { \(Y™ =2 bjOTj - P^Yj))) - 6i(Yi - P*(yT))]H} > 0. 
However, we can assume that all the Yj 's are distinct without loss of generality (since if there is 
a repetition of Xj's, we can simply add the coefficients &;), and if any Xi does not appear among 
the Yi's, we can add it, taking bi = 0. 
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PROOF. Observe that (10) is equivalent to the condition that, for all nonnegative 
reals 61, ... , b n -i, reals b n , and all i* , it is not the case that 

Y,HX i -i*)<bAX i ,-x*,). (11) 

Suppose, by way of contradiction, that there exist such nonnegative reals b\ , . . . , 6„_i 
and real b n . Note that, without loss of generality, we can assume that i* ^ n and 
that bj* = 1. For if b^ ^ 0, then we can divide both all coefficients on both sides 
by bi* to get an equivalent instance of (11) where bi* = 1. Moreover, observe that, 
since 7 n _i = false and j n — true, we have that X n _i = 0, x* n _ x = 0, X n = 1, and 
x* n = 1. Thus, if i* = n or if bi* = 0, then we can take i* = n — 1 and bi* = 1, to 
get an equivalent instance of (11). Thus, if there exist 61, . . . , b n and i* such that 
(11) holds, then we can assume without loss of generality that i* 7^ n and 6j* = 1. 

For simplicity, in the remainder of the argument, we take i* = 1 (the argument 
is the same for every choice of i* ^ n) and assume that b\ = 1. Since X n = 1 and 
x* n — 1, there exist nonnegative 62, ... , b' n _ 1 and e > such that 

n-l 

^(Xj-x^ + eKXi-xt 
3=2 

Let 6^ = e + x\ - £"=2 6^* (6^ can be negative). Note that ^J =2 = ^1 + e > 
since a;* = 1. Since X n — x* n = 0, it follows that 

n 

Y^b'jiXj - x*) + e < Xr - x\. 

Thus, Y?j=2b'jXj < X\. By definition of Bi, there exists (b^,---, b* n ) e B\ such 

that Y^i=-i < X\ and YLl=2 K x *i — Y^i=2 K x *i = x i + e - I n other words, we 
can assume without loss of generality that b 2 , . . . ,b n are in B\, since otherwise, 
we can always replace them by b%, . . . , 6* . By the above, we have that E(b' 2 X2 + 
. . . + b' n X n ) < E(X\). By the constraints corresponding to /1 in /, we can therefore 

derive b' 2 E(X 2 )-\ \-b' n _ 1 E(X n _i) + b' n < E(X\). (The constraints corresponding 

to fi where chosen so that exactly this derivation could be performed.) However, 
replacing b' n by e + x\ — Y^j=2 ^'j x j ano ^ replacing E(Xi) by x*, we get that e < 0, 
a contradiction. Thus, there cannot exist 61, . . . , b n of the above form. Hence, P* 
is coherent, as desired. □ 

Continuing with the proof of Theorem 5.2, by Lemma A. 7 and the Natural 
Extension Theorem, there exists a set of probability measures V such that E v 
is defined on all gambles, and E v agrees with P* on {Xi, . . . , X n }. It is routine to 
check that (W,V,tt) \= /', and hence (W,V,tt) \= f, as required. 

Theorem 5.3. AX 6el is a sound and complete axiomatization ofC E with respect 
to M bel . 

PROOF. Soundness is straightforward. For completeness, we proceed as in The- 
orem 5.1. Assume without loss of generality that / is a conjunction of expectation 
inequalities and their negations. Using axioms E7, E8, and E10 we can convert 
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/ into the equivalent formula f T2 G L E ' (Lemma A. 5) where e is applied only to 
propositional formulas. Every propositional formula ip in f T2 is provably equivalent 
to a region pi for some 1 < i < 2 2 . Since ip — pi is valid, e(<p) = e(pi) is provable 
by E5. This means that we can find a formula /' provably equivalent to f T2 , where 
e is applied only to formulas pi , . . . , p 22 N . Let /" be obtained from /' by adding 
as conjuncts to /' all the instances of E9 involving the regions pi, . . . , p 22 « , as well 

as the inequalities e(pi) > for all 1 < i < 2 2N , e(pi) > 1, — e(pi) > —1 and 
— e(/9 2 2«) > 0. (Recall that by assumption, p\ is true and p 22 « is false.) It is not 
hard to see that these formulas are provable, hence /" is provably equivalent to /', 
and hence to /. 

As before, the negation of an expectation inequality aie(7i) + • • • + a n e(-f n ) > b 
can be written — aie(7i) — • • • — a„e(7„) > —b. Thus, without loss of generality, 
we can assume that /" is the conjunction of formulas of the form a\e(pi) + ■ ■ ■ + 
s 2! »e(/) 2 j») > b and — a[e(pi) — ■ ■ ■ — a!^ N e(p 22 N ) > b' . Let / be the system of 
inequations obtained by replacing the terms e(pi) by the variable Xi, for 1 < i < 
2 2 . We claim that /" in satisfiablc in A4 bel iff the system / of equations has a 
solution. One direction is straightforward. Suppose that /" is satisfiable. Thus, 
there exists a belief structure (W, Bel, tt) such that (W, Bel, w) |= /". Clearly, taking 
Xi = i?Bci({|Pi[l-M) = Bel(pi) gives a solution to /. Conversely, suppose that / has a 
solution, say , . . . , x* 2 n • Let p\ 1 . . . ,pn be the primitive propositions appearing 
in / (and, hence, in /"). Define the belief structure M — (W, Bel, w) as follows: 

— W = {S\, . . . ,^2"}, the set of atoms over pi, . . . ,Pn', 

— Bel({5j 1 , . . . , Si k }) — x*, where i is the unique index such that V ... V 8i k is 
logically equivalent to the region pf, 

— ir(5i)(p) = true if and only if Si => p is a propositional tautology. 

It is straightforward to show that Bel defined in this way is a belief function. That 
Bel satisfies Bl and B2 follows from the fact that we must have xi = and x* N = 1. 
Similarly, that Bel satisfies B3 follows from the observation that any instance of B3 
corresponds to an instance of E9 that was added as an inequality in /, and thus 
is satisfied by the solution x\, . . . ,a;* 2 jv. Finally, that M \= f" holds also follows 

from the construction of /. Thus, /" is satisfiable. This completes the proof of the 
claim. 

Returning to the proof of the theorem, we want to show that if / is consistent, 
then / is satisfiable. So suppose that / is consistent and, by way of contradicition, 
that it is not satisfiable. Then /" is not satisfiable. Thus, by the claim, the system of 
equations / has no solution. Thus, ->f" is an instance of the axiom Ineq. Since /" 
is provably equivalent to /, it follows that -■/ is provable, so that / is inconsistent, 
a contradiction. □ 

Theorem 5.4. AX poss is a sound and complete axiomatization of C E with 
respect to M poss . 

Proof. Soundness is straightforward. For completeness, we proceed almost 
exactly as in Theorem 5.3. As before, we can reduce to showing that a for- 
mula / consistent with AX poss that is a conjunction of formulas of the form 
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aie(pi) + • • • + a 2 2« e(p 22 jv ) > b and — a[e(pi) — ■ ■ ■ — o!^ N e{p 22 N ) > b' is satisfiablc. 
We add as conjuncts to this formula all the expectation inequalities corresponding 
to Ell involving the regions pi, . . . , p 22 N , as well as the inequalities e(pi) > for 
all 1 < i < 2 2 ™ , e(pi) > 1, — e(p\) > —1 and — e(p 22 jv) > 0. Again, let / be 
the system of inequations formed by replacing e(pi) by x t . Arguments similar in 
spirit to those of Theorem 5.3 can be used to show that / has a solution iff there 
is a structure in M poss satisfying /; we leave details to the reader. The proof is 
completed using Ineq, just as the earlier completeness proofs. □ 

A. 4 Proofs for Section 6 

As in FHM and HP, the small model theorems we prove rely on the following lemma, 
which can be derived from Cramer's rule [Shores 1999] and simple estimates on the 
size of the determinant (see also Chvatal [1983] for a simpler variant): 

Lemma A. 8. // a system of r linear equalities and/or inequalities with integer 
coefficients, each of length at most I, has a nonnegative solution, then it has a 
nonnegative solution with at most r positive entries, where the size of each element 
of the solution is 0(rl + r log(r)). 

Before getting to the small model theorems, we first establish a finite model 
theorem, that is, we show that, for all the representations of uncertainty we consider 
in this paper, if a formula in C E is satisfiable, it is in fact satisfiable in a structure 
with finitely many states. This is a consequence of the completeness proofs in 
Section 5. 

Lemma A. 9. Suppose f e C E is satisfied in some structure in M prob (resp., 
M lp , M hel , M poss ). Then f is satisfied in a structure in M prob (resp., M lp , 
M bel , M poss ) with finitely many states. 

Proof. In each of the proofs of Theorems 5.1-5.4, we show that a formula 
is satisfiablc iff a certain system of inequations has a solution. The system of 
inequations involves only finitely many variables. Our argument showing that if 
the system of inequations is satisfiablc, then there is a structure where the formula 
is satisfied actually shows that the satisfying structure has only finitely many states, 
with no more than one state per variable in the system. □ 

Note for future reference that the satisfying structures in A4 prob and M. lp con- 
structed in the proofs of Theorems 5.1 and 5.2 are such that all subsets are mea- 
surable. 

Theorem 6.1. Suppose that f G C E is satisfied in some structure in M lp . Then 
f is satisfied in a structure (W,V,ir) such that \W\ < \f\ 2 , \P\ < |/|, p{w) is 
a rational number such that \\p(w)\\ is 0(|/| 2 ||/|| + |/| 2 log(|/|)) for every world 
w G W and p G V , and tt(w)(p) = false for every world w G W and every primitive 
proposition p not appearing in f. 

Proof. The first step in the proof involves showing that if V is a set of proba- 
bility measures defined on a finite space W (assuming all subsets are measurable), 
and if Xi,... ,X n are gambles over W, then we can assume without loss of gen- 
erality that for each gamble Xi, there is a probability measure px { € V such 
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that E l j iX \X i ) = E v (Xi) (rather than E v (Xi) just being the inf of E^(Xi) for 
/i e V). A similar result is proved in HP for upper probabilities. More specifically, 
in HP, it is shown that, given V, there exists a set V' 2 V such that, for each 
S C W, E v (Xs) = E v ,(Xs) and, moreover, there exists some fis e "P' such 
that fis(S) = E V (X S ). The next result can be viewed as a generalization of this 
result to arbitrary gambles. It is proved using essentially the same technique as the 
corresponding result in HP. 

Lemma A. 10. Let V be a set of probability measures defined on a finite set W 
of worlds, and let X\, . . . ,X n be gambles over W. Then there exists a set V' of 
probability measures such that, for each gamble Xi, (a) E_ v (Xi) = E_ v ,(Xi), and 
(b) there is a probability measure jjbXi € V such that E fix (Xi) = Ep(Xi). 

Proof. To show that V' exists, it clearly suffices to show that, for each gamble 
X e {Xi, . . . , X n }, there is a probability measure fix such that E^ x (Y) > E V ,(Y) 
for all Y e {X u . . . , X n } and E^ x (X) = E V (X). 

Given a gamble X e {X\, ■ • • , X n }, if there exists fi e V such that E^(X) = 
E V (X), then we are done. If not, there must be a sequence fi\, fi2, ■ ■ • of measures 
in V such that lim^oo E^ n (X) — E V (X). Suppose that W = {w\, . . . , w n }. By 
the Bolzano- Weierstrass theorem [Rudin 1976] (which says that every sequence of 
real numbers has a convergent subsequence), the sequence ^2(^1), fi 3 (wi), 

. . . has a convergent subsequence. Suppose, inductively, that we have found a 
subsequence /U^i, /i J; 2, . . . of fi\,fi2,--- such that fij^w), fij^(w), fij^(w), . . . con- 
verges for w G {wi, . . . ,Wj}. By applying the Bolzano- Weierstrass Theorem again, 
there is a subsequence fij + i t i, /Xj + 2,i, • • • of fj,j t i, fJ>j,2, ■ ■ ■ such that ^+1^(^+1), 
^+2,1(^+1), • ■ ■ converges. It follows that /j,j + i^(w), fij+2, w )i ■ ■ ■ converges for all 
w e {wi, . . . , Wj + i}. By induction, we can find a subsequence n n ,i,Hn,2, ■ • • of the 
original sequence such that /z nj i(w), iin^w), ■ ■ ■ converges for all w £ W. Suppose 
that fJ, n ,i{wi), Hn,2(wi), . . . converges to p,. It is easy to see that p\ + ■ ■ ■ +p n = 1, 
since Y^i=i Vnjiwi) = 1 for all j. Let \±x be the probability measure such that 
\x(wi) = Pi- Since fi n j — > fix, it must be the case that E^ X (X) = Ep(X). 
Moreover, since fi n j G V for all j, it must be the case that AY) > E_ V (Y) 
for all j. Thus, E^ x (Y) > E V (Y), as desired. 

Now let V = V U {/j^i j • • • j Mx„}- T~" clearly has the desired properties. □ 

Continuing with the proof of Theorem 6.1, suppose that / is satisfiable in A4 lp . 
By Lemma A. 9, / is satisfied in a lower probability structure with a finite set W 
of worlds. Thus, by Lemma A. 10, / is satisfied in a structure M = (W,V,tt) such 
that, for all X e {Xx, X n }, there exists fi x <E V such that E^ x (X) = E V (X). 

The rest of the proof also continues in much the same spirit as the proof of the 
analogous result in HP. A straightforward induction on structures shows that we 
can find a formula equivalent to / in disjunctive normal form, where each disjunct 
has length at most |/|. (The inductive hypothesis states that we can find both a 
DNF formula equivalent to / where each disjunct has length at most |/|, and a 
CNF formula equivalent to / where each conjunct has length at most |/|.) Since a 
formula in DNF is satisfiable iff one of its disjuncts is, we can thus assume without 
loss of generality that / is a conjunction of inequality formulas and negations of 
inequality formulas. Let pi, . . . ,p^ be the primitive formulas appearing in /. Let 
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S\, ... , S 2 n be the atoms over pi, . . . ,Pn- As in the proof of completeness, we derive 
a system of equalities and inequalities from /, but it is a slightly more complicated 
system than that used in the completeness proof. Recall that each propositional 
formula over pi , . . . , pjy is a disjunction of atoms. Let 71, . . . , 7fc be the propositional 
gambles that appear in g. Notice that k < |/| (since there are some symbols in /, 
such as the coefficients, that are not in the propositional formulas). The system 
of equations and inequalities we construct involve variables Xij , where i = 1 , . . . , k 
and j — 1,...,2 N . Intuitively, represents ^([^'Im), where e V is such 
that Ep y . (^Ji^m) = E v (§~fi\M)- Thus, the system includes k < |/| equations of 
the form 

x a H h x i2 N = 1, 

for i — l,...,k. Suppose that 7^ is equivalent to bn§i + ••• + b i2 N8 2 N. Then 

bnxn H Vb l2 NX l2 N represents E^.{{^ M )- Since E^.(^i} M ) < ^(HIW 

for all 11 G V, the system includes k2 — k inequalities of the form 

bnxn H h b i2 NX i2 N < b ix x vx H h b l2 NX V2 N , 

for each pair i, i' such that i ^ i' . For each conjunct in g of the form aie(-ji) + • • • + 
«ne(7fc) > 6, there is a corresponding inequality where, roughly speaking, we replace 

e(7i) by E^^,} M )- 12 Since E^^i\ M corresponds to bnxn H b i2 NX i2 N, the 

appropriate inequality is 

k 

^ ^(^1^1 H 1- b i2 NX l2 N) > b. 

i=l 

Negations of such formulas correspond to a negated inequality formula; as before, 
this is equivalent to a formula of the form 

k 

-{y^aijbj-LXn H \-b i2 NX l2N ) > -b. 

i=l 

Notice that there are at most |/| inequalities corresponding to the conjuncts of /. 
Thus, altogether, there are at most k(k — 1) + 2|/| < |/| 2 equations and inequalities 
in the system (since k < |/|). We know that the system has a nonnegative solution 
(taking to be M7i([^j]M))- It follows from Lemma A. 8 that the system has a 
solution x* = (xl x , . . . ,x* 12N , . . . ,x* kl , . . . ,x* k2N ) with t < |/| 2 entries positive, and 
with each entry of size 0(|/| 2 ||/|| + |/| 2 log(|/|)). 

We use this solution to construct a small structure satisfying the formula /. Let 
I = {i : x*j is positive, for some j}; suppose that / = {ii, . . . ,i t /} for some t' < t. 
Let M = (WjV, 7r), where W has t' worlds, say si, . . . , Sf. Let ir(sh) be the truth 
assignment corresponding to the formula Si h , that is, it{sh){p) — true if and only 
if 8i h p is a propositional tautology (and where n(sh)(p) = false if p docs not 
appear in /). Define V = {fij : 1 < i < fc}, where /ij(sh) — %* h j- It is clear 
from the construction that M |= /. Since \V\ = k < |/|, \W\ = t' < t < |/| 2 and 



For simplicity here, we are implicitly assuming that each of the formulas 7; appears in each 
conjunct of /. This is without loss of generality, since if 7; does not appear, we can put it in, 
taking = 0. 
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Atj(sh) = x* hj , where, by construction, the size of x* hj is 0(|/| 2 ||/|| + \.f\ 2 log(|/|)), 
the theorem follows. 

Theorem 6.2. Suppose that f e C E is satisfied in some structure in M bel 
(resp., Ai poss ). Then f is satisfied in a structure (W,v,ir) such that \W\ < \ f\ 2 , v 
is a belief junction (resp., possibility measure) whose corresponding mass function 
is positive on at most \f\ subsets ofW and the mass of each of these \ f\ is a rational 
number of size 0(\f\ ||/|| + |/|log(|/|)), andir{w){p) = false for every world w G W 
and every primitive proposition p not appearing in f . 

Proof. First, consider expectation for belief functions. The proof is similar in 
spirit to the proof of the small model theorem for reasoning about belief functions 
given in FHM. In FHM, the complexity result used the representation of belief 
functions in terms of mass functions. We do that here too; to do so, it is helpful to 
have an alternate characterization of expectation for belief that uses mass functions. 

Given a belief function Bel over a finite set W of worlds, let m be the correspond- 
ing mass function. For a given gamble X, let Vu = min^gj/ X(w). 

Lemma A. 11. E Bel (X) = J^ucw m( u ) v u- 

PROOF. Suppose that Bel is a belief function on W with corresponding mass 
function m, and X is a gamble on a finite set W = {wi, . . . , w n }, where the elements 
of W are ordered so that i < j implies X(wi) < X(wj). For each U C W, let 
ijj — min{i : Wi <G U}; note that vu = X{vji u ). 

E Bcl (X) = E m(U) Vu . 
ucw 

We want to show that E_ Bcl (X) = E Be \(X). 

Recall from Section 2.3 that E Be \ = E-p B , where P Be \ is the set {/i : /j,(U) > 
Bel({7) for all U C W}. As a first step, let be a probability measure on W such 
that Ho(X = x) = J2{u-v u= x} m {U). (Note that fio is a probability measure, since 

]T ^X = x = E m(C/) = ^ m(f/) = 1, 

xeV(X) xeV(X) {U:v v =x} ucw 

since m is a mass function.) Clearly 

w= E wo(x = X )= E ^ E m ( c/ ) 

xCV(X) xEV(X) {U:vu=x} 

= m(U) Vu = E Bcl (X). 
ucw 

Moreover, for all U C W, since Ho(U) = X^y-u^ eu} m (V)> anc ^ ^ f° r 

all V C [/, it follows that /j, (U) > T,{v. Wi eu} m ( V ) = ^l(U). It follows that 
Mo G £W Thus, 

£ Bcl (X)^ (A)> inf ^(X)= J Bp Bel (X)= J B B eiW. 

To show that E-p (X) > E Bcl (X), let x\ < ■ ■ ■ < Xk be the values of X in 
increasing order, and let Uj — U^ =1 (X = xj) = {w € W : < x^}. We 
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claim that po(Uj) = Plaus([/j), j — 1, . . . ,k. This is almost immediate from the 
definition, since 

Vo(Uj)= rn{U) = Yl m(U) =Pl&us(U 3 ). 

{U:vu<x 3 } {U:UnUj^0} 

It follows that if p € Vseh then po(Uj) > p(Uj), for j = 1,... ,k (since /x(C/j) < 
Plaus(J7j)). For convenience, define f/n = 0. Then we get that 

- £7 W (X) - £*U*i(M* = *0 - MX = Xi )) 

= x k (p(U k ) - po(U k )) + Z) i= i (a;»+i - Xi){no{Ui) - p(Ui)) 
> 0. 

The last inequality follows from the fact that p(U k ) = Po(U k ) = A*o(W) = 1) 
a; i+ i > x i; and /io(#i) > M^*) for i = 1, . . . , fc - 1. Thus, E^X) = E V ^(X). It 
follows that £ Bc iP0 = E Vbo1 (X). □ 

Continuing with the proof of Theorem 6.2, suppose that / £ C E is satisfiable 
in structure M. As in the proof of Theorem 6.1, we can assume without loss of 
generality that / is a conjunction of expectation formulas and their negations. Let 
Si, ... , 5 2 n be the atoms over p\, . . . ,Pn- Let pi, . . . , p 22 jv be all the inequivalent 
propositional formulas over p\, . . . ,pjy. 

As in the proof of completeness, we derive a system of equalities and inequalities 
from /. First, note that every propositional formula appearing in the gambles of / 
is provably equivalent to some region pi. Therefore, we can replace every gamble 
in / by an equivalent gamble where the propositional formulas are the regions 
/?!,..., p 22 N . Let /' be resulting formula. Clearly, M \= f . Construct the following 
system of linear inequalities over the variables x\, . . . , x 22 n , where, intuitively, the 
variable Xi stands for the mass corresponding to the set pi. For every gamble 7 
that appears in /' every pi, we can compute values w 7i j = xmn we f p .j M (^'y^M(u!))- 

For every gamble 7, replace every term e(j) in /' by £ i=1 XiV^^. Consider the 
system j' of at most |/| inequalities (over unknowns x\, . . . , x 22 n) resulting from 
this process, after putting together like terms, along with the inequalities x\ + ■ ■ ■ + 
x 22 n > 1 and —x\ — ■ ■ ■ — x 22 n > — 1. 

We now show that any nonnegative solution x\,. . . ,x* 2 „ of f can be used to 
construct a belief function Bel* such that (W, Bel*,7r) |= /'. (Note that we keep 
the same worlds and interpretation as in M .) Let x*, . . . , x* 2lv be a nonnegative 

solution of /. Define the mass function m*([/9j]M) = x*, and define m*(U) = 
for all U C W such that U is not of the form [p|m for some region p. Because 
X1 + ... + x*^ 2N = 1 (by choice of /'), m* is indeed a mass function. Let Bel* 
be the belief function corresponding to to*, and let M* = (W, Bei*,7r). Since the 
interpretation of propositional formulas and gambles depends only on the set of 
worlds and the interpretation it, for all propositional formulas pi, we have [pi]m = 
[Pi]m*, and for all gambles 7 appearing in /', we have |7[}m = {]7|}m*- We now 
show that M* \= /'. Let aie(7i) + . . . + a k e(j k ) > b be a conjunct in /'. (A similar 
argument works for the negation of expectation inequalities.) We know from the 
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construction of /' and the fact that x\, . . . , x^ 2N is a solution of /' that 

2 2JY 2 2 



2 2 



»=1 i=l 



By definition, this is just 



aiVm*([pi]M) min (|7i|}mH) + ■ • • + 
— : weipijM 

2—1 

,1V 

2 2 

afeY]m*([^]M) min (]]7fc|}M(w)) > b. 

2—1 

Since every subset of VF is of the form [p^Af for some i, we have 

ai y~] m*(U) min({|7i|}M(w)) + . . . + a fe V" m*(?7) min({]7 fe |}M(w)) > 

But by Lemma A. 11, this is just ai-E Be i* ({|7i|}m) + •■• + a/c^Bd* (Ht/cB-m) > 6, 
which is equivalent to aiE Bc i'(^7iftM*) + ... + a k E Bc i* (H7fc|}M*) > o, and thus 
M* \= a ie (7i) + . . . + a fc e(7 fc ) > 6. It follows that M* \= /'. 

Because /' is satisfiable in M, there is in fact a nonnegative solution to the 
system /', where x; t = m([pi]M) and m is the mass function corresponding to 
the belief function in M. By Lemma A. 8, there is a small nonnegative solution 
x\, . . . ,a;* 2N , that is, one with at most |/| positive entries and each entry of size 
0((|/|)||/|| + (|/|)log(|/|)). By the argument above, xl, . . . , a;* 2 N can be used to 
construct a model M* = (W, Bel*,7r) such that M* \= f. We are not quite done 
yet; while we have a small mass function, we still have potentially too many worlds. 
We now show how to cut down the number of worlds in the model to get a small 
enough structure M' . 

Let {ii, . . . = {i ■ m *{\Pi\M*) > 0}. Let 7i,...,7fc be the gambles in 

/'. For i e {1, . . . , k} and j € {1, . . . , |/|}, there is some Wij G [p^Jm* such that 
fai$M{wi,j) = min M , e[ ^ lM ({|7 l B- M (u;)); that is, w hJ is a world where {^ l \ M attains 
its minimum value. Define M' = (W , Bel', it') as follows. Let the set of states W be 
{wij : i e {1, . . . , k},j E {1, . . . , |/|}}. Let Bel' be the belief function whose corre- 
sponding mass function m! is defined by setting m'({wij, . . . , w k j}) — ^*([Pi,1m*) 
for j = 1, . . . , |/|, and m'(U) = if U is not [PiJm* for some j e {1, . . . , |/|}. 
The interpretation ir' is simply the restriction of tt to W , with n(w)(p) — false for 
primitive propositions p not appearing in /. This model satisfies the size conditions 
of the theorem. 

We now check that /' (and hence /) is satisfiable in M'. It is clearly sufficient to 
show that for every gamble 7* in /', we have E Be i* (174m*) = E Bc y(^^ M ')- To 
do this, we show that 

h&M*(wi,j) = min (fttU-M' (w r ,j))- (12) 

l<r<K 

By choice of Wij, h^M* = miii welpij j M , (in^M* {w)). Since {w ld , w k ,j} 
is a subset of [PjJm*, it follows that {^Hm* (w it j) = ^^i<r<k(ilil m* (w r ,j))- 
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Next note that for all w € {w\,j, ■ ■ ■ , w k,j}, we have that §"fi$M'(w) — §ji$M'(w). 
For if 7, = c lPn + ... + cipj,, then = d x l Pj J M * + ■■■ + c l x l Pj J M * and 

\li$M' = c i x l P]1 l M , + • • • + c l X l PH } M ,- Sincc 7r ' is tnc restriction of tt* to W, 
it follows that [p^Jm* = [p.j»]m' H W'. Since • • • , Wk,j} Q W, it follows 

that X lp . j M ,(w) = Xj P3iIm ,(w;) for all u> e {wij, . . . , w kJ }. Thus, ll^M-H = 
\li\sM'{w) for all w G {wij, ■ • ■ , Wfcj}. We can now show that -EbcI* ({iTiB'M* ) = 

£ B el'(MM'): 

EBel'dliftM*) 
= Ei=l m *([PilM*) min «;eMM.(l74M*H) 

= Ei=i TO *([PijM0 min ^eMM.({l74M.H) (since m*(t/) = if U ^ [piJm*) 
= El=i w*([piJ M *)l7»|}-M*(i«i,j) (by choice of Wi j) 
= EI=i m '({»ij.- ■ • > Wk,j})h4M* {Wi,j) 

= Ei=i m '({ w ij J ---> w fcj}) min i<r<fe({|7j|}M'( u; rj)) (by (12)) 

= J2ucw m '(U) minw e U(§ji$M'(w)) (adding sets for which m'(U) = 0) 

From this result, it is easy to see that M' \= /', and hence M' |= /. This establishes 
the small-model result for C E interpreted over belief functions. 

Essentially the same argument works in the case of possibility measures. Recall 
that a possibility measure Poss is just a plausibility function, whose corresponding 
mass function m is consonant; that is, for all sets U, V such that m(U) > and 
m(V) > 0, we have either U C V or V C U [Dubois and Prade 1982]. In other 
words, the sets of positive mass U\,. . . ,Uh can be ordered such that U\ C . . . C 
Uk- We then proceed much as for belief functions. We construct a system of 
inequalities over the variables x\, . . . ,x k , where, Using Lemma A. 8 again, because 
/' is satisfiablc in M, there is a small nonnegative solution x\,...,x* k , with at 
most |/| positive entries, each of small size. We can then use this solution to build 
a structure satisfying / where the mass function is consonant and positive on at 
most |/| sets. This follows directly from the fact that the only sets of positive 
mass will be among Ui, . . . ,U k , which are already such that Ui C ... C U k -) The 
remainder of the proof goes through as in the belief function case. 

Theorem 6.3. The problem of deciding whether a formula in C E is satisfiable 
in M prob (resp., M lp , M bel , M poss ) is NP-complete. 

Proof. The result for J\A prob is immediate from the proof that the satisfiability 
problem for jCf U (the restriction of £® u to rational coefficents) is NP-complete, 
together with the argument in Theorem 4.1 showing that every formula in C E is 
equivalent to a formula in C® U of the same length (where the formula is essentially 
given by the translation of Lemma A. 4). 

Consider M lp . The lower bound follows from the fact that we can reduce 
propositional satisfiability to the decision problem for £ E ; hence the problem is 
NP-hard (by replacing each proposition p by the formula e{p) = 1). The upper 
bound follows from Theorem 6.1. Given a formula /, first guess a small model 
M = (W, V, w), of the form guaranteed to exist by Theorem 6.1. (The fact that 
tt(w)(p) = false for every world w € W and every primitive proposition p not 
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appearing in / means that we must describe it only for propositions that appear in 
/.) We can verify that M \= f inductively. For inequality formulas, let e(j) be an 
arbitrary expectation term in the formula, with 7 of the form b±ipi + • • • + b n ip n . 
For each ip in 7, we compute [v?]m by checking the truth assignment of each world 
in W and seeing whether this truth assignment makes ip true. We then replace 
each occurrence of e(~i) by rnin^g-pj^^j ~^2 we ^ .j M bi/j,(w)} and verify that the 
resulting inequality holds. It is easy to see that this verification can be done in 
time polynomial in |/| and ||/||. Therefore, the decision problem is in NP, and 
hence is NP-complete. 

Finally, consider J\A hel and Ai poss . As earlier, the lower bound follows from the 
fact that we can reduce propositional satisfiability to the decision problem for C E ; 
hence, the problem is NP-hard. Again, the upper bound follows from Theorem 6.2. 
Given a formula /, guess a small model M — (W, v, n) of the form guaranteed 
to exist by Theorem 6.2, along with sets U\, . . . , U s (s < |/|) such that the mass 
function corresponding to the belief function (respectively, possibility measure) v 
is positive only on U\, . . . , U s . We then verify that / is indeed true at some (and 
hence all) states in the model, just as in the case of A4 lp . □ 

A. 5 Proofs for Section 7 

The following lemmas are useful in the proof of Theorem 7. 1 . 
Lemma A. 12. The formula <p > is provable in AX 5 . 
PROOF. Here is a sketch of the derivation: 

(1) true = 1 (G3) 

(2) ifV ^(p= true (G4) 

(3) ip V ~^(p = ip + ~^(p (Gl) 

(4) ip + -nip = 1 (1, 2, 3, IneqF, Taut, MP) 

(5) ip + ^<p > (4, IneqF) 

(6) ip > 6 (5, G2). 

□ 

Lemma A. 13. The formula (aip + b^ip >0)^>(ip~0) is provable in AX 5 , for 
a < 0. 

Proof. Here is a sketch of the derivation: 

(1) cup + b^ip > 6 => aip > 6 (G2, Taut, MP) 

(2) aip > => tp < (IneqF, since a < 0) 

(3) ip > (Lemma A.12) 

(4) aip + b^ip > 6 ip = 6 (1, 2, 3, Taut, MP, definition of =). 
□ 

Theorem 7.1. AX 9 is a sound and complete axiomatization of C 9 with respect 
to M g . 
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Proof. Soundness is straightforward. For completeness, we show that an un- 
satisfiable formula / is inconsistent. We first reduce / to a canonical form. Let 
gi V . . . V g r be a disjunctive normal form expression for / (where each gi is 
a conjunction of gamble inequalities and their negations). Using propositional 
reasoning (axioms Taut and MP), we can show that / is provably equivalent to 
this disjunction. Since / is unsatisfiable, each gi must also be unsatisfiablc. Thus, 
it is sufficient to show that any unsatisfiable conjunction of gamble inequalities and 
their negations is inconsistent. 

Let / be such an unsatisfiable conjunction of gamble inequalities and their 
negations. Let pi,...,pn be the primitive propositions appearing in /, and let 
Si, . . . , 5 2 n be a canonical listing of the atoms over pi, . . . ,pn- We first show 
that any gamble inequality 7 > c is provably equivalent to a gamble inequality 
aiSi + • • • + a 2 N<5 2 iv > 0. Consider a term atp appearing in 7 > c. Since tp is 
equivalent to a disjunction Si 1 V . . .V S ik , we have that tp = Si ± V . . . V Si k , and hence 
a<p — a(Si ± V . . . V 6i k ), is provable by G4 and IneqF. By repeated applications of 
GI, we have that a(5i 1 V . . . V S. ik ) = aS il + • • • + aSi k is provable. (Note that if ip 
and tp' are mutually exclusive, then ip V <p' is equivalent to ip A ip V <p' A -up, so by 
GI, tp V <p' = (p + tp' .) By IneqF, atp = aS il + • • • + aSi k is provable too. Using 
IneqF again, it follows that atp — aiSi + • • • + <i 2 nS 2 n is provable, where a, = a 
if i € {ii, . . . , ik}, and a* = otherwise. Doing this to every term in 7 shows that 
here exist 61, ... , b 2 ™ such that 7 = biSi + ■ ■ ■ + b 2 NS 2 N is provable. Hence, using 
IneqF, so is aiSi + • • • + o, 2 nS 2 n > c. By G3, true = 1 is provable, hence so is 

c true = c. It then easily follows using IneqF that cSi H h cS 2 n = c is provable. 

Thus, 7 > c is provably equivalent to (ai —c)S\ + - ■ ■ + (a 2 w — c)S 2 n > 0, as required. 

It immediately follows that / is provably equivalent to a formula /' that is a 
conjunction of gamble inequalities of the form ai<5i + • • • + o, 2 nS 2 n > and their 
negations. Say that /' consists of r gamble inequalities and s negations of gamble 
inequalities. Consider two arrays of coefficients of /": P = (aij), where djj is 
the coefficient of 5j in a^i^i + • • • + a i 2 N5 2 N > (1 < i < r), and N — (bij), 
where bij is the coefficient of 8j in + • • • + b i 2 NS 2 N > 0) (1 < i < s). Let 

I = {1, . . . , 2^}. Note that, since / is unsatisfiable, so is /'. If a^j < for some 
then, by Lemma A. 13, we must have Sj — 0. Let /" = {j : atj < for some i}; 
let I' = I — I" . Let P' and N' be the result of setting all entries in column j of 
P (resp., N) to 0, for all j e I". The formula /" corresponding to the matrices 
P' and N' is provably equivalent to the original /', by IneqF: since Sj = for all 
j E I", it must be the case that aSj = 0. By construction, all entries in P' and N' 
are nonnegative; moreover, N' is nonempty (since ->(—5i — ■ ■ ■ — S 2 n > 0) is in /"). 

There are now two cases. Taking N' = (b'tj), note that if N' has a row i with 
all entries nonnegative, then /" provably implies that — i(0<5i + • • • + 0r) 2 » > 0). But 
using IneqF, it is easy to show that OSi + • • • + 0<5 2 n = 0. This shows that /", 
and hence /' and /, is inconsistent. On the other hand, if all the rows in N' have 
a negative entry, then the formula corresponding to P' , N' is in fact satisfiable. 
We can construct a structure M satisfying /' by taking M = ({Si : i G I'}, it), 
where ir(Si)(p) = true if Si => p is a propositional tautology. This contradicts the 
assumption that /' is unsatisfiable. □ 

The proof of Theorem 7.2 relics on the following small- model result. 
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Lemma A. 14. Suppose that f <G L\ is satisfied in some structure in A4 9 . Then 
f is satisfied in a structure (W, tt) where \W\ < \ f\, and n(w)(p) = false for every 
world w G W and every primitive proposition p not appearing in f. 

Proof. Suppose that / S L\ is satisfied in a structure M = (W, tt). conjunction 
of gamble inequalities and their negations. We want to show that / is in fact 
satisfied in a small structure. As usual, we can assume without loss of generality 
that / is a conjunction of gamble inequalities and their negations. 

Suppose that there are r gamble inequalities in / and s negations of gamble 
inequalities. We consider two cases. If s = 0, then pick any w £ W and let M' — 
(W',tt'), with W' = {w}, and tt' is the restriction of tt to {w} (setting 7r(u>)(p) = 
false for every primitive proposition p not appearing in /. It is easy to check that 
M' \= f, since w <E W. If s > 0, then for every negation of gamble inequality 
"■(7 > c) appearing in /, there exists a world w <G W such that {|7B-m(w) < c. Let 
W\ , . . . , w s be such worlds, one corresponding to each of the s negation of gamble 
inequalities appearing in /. Let M' = (W , tt'), where W — {w\, . . . , w s }, and tt' is 
the restriction of tt to W (setting tt'(w)(p) = false for primitive propositions p not 
appearing in /). Clearly, every gamble inequality in / is satisfied in M', since W 
is a subset of W . Moreover, by choice of W' , every negation of gamble inequality 
in / is also satisfied in M' (since our construction guarantees that there is world 
in M' that is a witness to the falsity of all the negated gamble inequalities in /). 
Since \W'\ = s < |/|, the result follows. □ 

Theorem 7.2. The problem of deciding whether a formula of C\ is satisfiable 
in Ai 9 is NP-complete. 

PROOF. For the lower bound, observe that £f includes propositional reasoning. 
Hence, the decision problem for C\ is at least as hard as propositional reasoning. 

For the upper bound, let / be a satisfiable formula of £f. We first guess a 
small model M = (W, tt) for the formula, of the form guaranteed to exist by 
Lemma A. 14. (As usual, the fact that w(w)(p) = false for every world w e W 
and every primitive proposition p not appearing in / means that we must describe 
tt only for propositions that appear in /.) We verify that M \= f inductively. For 
basic formulas of the form 7 > c, we must check that for all w € W, {]7|}m(w) > c. 
If 7 is of the form 61^1 + • • • + b n (p n , then we can compute {|7[1-m(w) by summing 
all the hi such that <pi is true at w (i.e., Tr(w)(ipi) = true). It is easy to see that 
this verification can all be done in time polynomial in |/| and ||/||. □ 

The following notation is useful for the proofs of Theorem 7.3 and Lemma A. 18. 
Given a linear inequality formula / (over real-valued functions) t > c, we write / 
for the linear inequality formula t > c over the reals. We extend this to Boolean 
combinations of linear inequality formulas in the obvious way. 

For the sake of our proof of completeness of AX^ , we need also to show that the 
following formula is provable: 

Owi + . . . + 0v n > 6 (13) 

This formula can be viewed as saying that the right implication of axiom 15 holds 
when d = 0. 

Lemma A. 15. The formula (13) is provable from AX^ . 
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Proof. By Fl, v\ > v\, that is, v\ — v\ > 6, is provable. By axiom F3, so 
is —v\ + vi > 0. If wc add these latter two inequalities by F4, and delete a 
term by F2, we obtain Ovi > 0. By using F2 to add terms, it follows that 
0i>i + . . . + 0t>„ > is provable, as desired. □ 

Theorem 7.3. AX^ is sound and complete for reasoning about formulas about 
linear inequalities over real-valued functions with nonempty domain. 

Proof. Soundness is straightforward. For completeness, wc show that an un- 
satisfiable formula / is inconsistent. So suppose that / is unsatisfiable. As usual, 
without loss of generality, we can assume that / is a conjunction of inequalities 
and their negations, say, with r inequalities and s negations of inequalities. We 
prove the result by reducing satisfiability of inequalities over real-valued functions 
to satisfiability of inequalities over real numbers, and then apply techniques from 
FHM. 

There are two cases. First, suppose that s — 0, so that there are no negations 
of inequalities in /. It is easy to see that since / is unsatisfiable over functions, / 
must be unsatisfiable over the reals. For if / were satisfiable over the reals with 
a solution x\ , . . . , x% , then / would be satisfied by taking Xi to be the constant 
function that always returns x*. 

Write / in matrix form as Ax > b, where A is the r x k matrix of coefficients on 
the left-hand side of the inequalities, x is the column vector (x\, . . . , Xk), and b is the 
column vector of the right-hand sides of the inequalities. Since / is unsatisfiable, 
Ax > b is unsatisfiable. As in FHM, we make use of the following variant of Farkas' 
lemma [Farkas 1902] (see Schrijver [1986, page 89]) from linear programming. 

Lemma A. 16. If Ax >b is unsatisfiable, then there exists a row vector u such 
that 

(1) a>6; 

(2) aA = 6; 

(3) a- b > 0. 

Intuitively, a is a "witness" or "blatant proof" of the fact that Ax > b is un- 
satisfiable. This is because if there were a vector x satisfying Ax > b, then 
= (aA)x = a (Ax) > ab > 0, a contradiction. 

We now show that / must be inconsistent. Let a = (o\, . . . , a r ) be the row 
vector guaranteed to exist by Lemma A. 16. Either by F5 or by Lemma A. 15 
(depending on whether Oj > or Oj — 0), we can multiply both sides of the j th 
conjunct of / by o~j (for 1 < j ' < r), and then use F4 to add the resulting inequality 
formulas together. The net result (after deleting some terms by F2) is the formula 
(Ovi > c), where c = a-b > 0. From this formula, by F6, we can conclude (Ovi > 0), 
which by the definition of > implies ~^(0vi < 0), which is in turn an abbreviation 
for ^(—O^i > —0), that is, -*(0vi > 0). Thus / => -i(0ui > 0) is provable. However, 
by Lemma A. 15, (Ovi > 0) is also provable. It follows by propositional reasoning 
that ->f is provable, that is, / is inconsistent, as required. 

Now suppose that s > 0. Let / + be the conjunction of the inequalities in /, and 
let gi, . . . ,g s be the negations of inequalities in /. That is, / = f + hgi A. . .Ag s . We 
first show that, / + A gi must be unsatisfiable over the reals for some i G {1, . . . , s}. 
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Assume by way of contradiction that this is not the case, that is, for all 1 < i < s, 
f + A cji is satisfiable over the reals. Let x\ i , . . . , x k i be the real number solution to 
the inequalities / + A g i} and let D = . . . , d s }. Define the functions F£, . . . , F£ 
over D by taking F*(di) = x* ^ It is easy to verify that / = /+ A g\ A . . . A g s is 

satisfied by those functions. Intuitively for every element di of the domain, / + is 
satisifed by Ff(di),. . . , F£(di), so that / + is satisfied by F{, . . . , F£; moreover, each 
gi is also satisfied, since by the choice of di, we have a-iF*(di) + . . . + a k Fj^(di) < c. 
Hence, / is satisfiable over real- valued functions, a contradiction. Therefore, f + /\<ji 
is unsatisfiable over the real numbers for some i - As in the case s = 0, we use this 
fact to show that / is inconsistent. 

As before, we can write / + in matrix form as Ax > b. Similarly, the formula 
g i() = -i(aiXi + . . . + akXk > c) can be written in matrix form as A'x > — c, where 
A' is the 1 x s matrix [— a\, . . . , —at], and x is the column vector (xi, . . . , Xfe). Since 
/ + ^9i 1S unsatisfiable, the system Ax > b, A'x > — c must be unsatisfiable. Farkas' 
lemma does not apply, but a variant of it, called Motzkin's transposition theorem, 
which is due to Fourier [1826], Kuhn [1956], and Motzkin [1956] (see Schrijver [1986, 
page 94]), does. 

Lemma A. 17. If the system Ax > b,A'x > — c is unsatisfiable, then there exist 
a row vector a and a real a' such that 

(1) a > and a' > 0; 

(2) a A + a' A' = 0; 
(5) either 

(a) a' = and a ■ b > 0, or 
(6) a' > and a -b- cr'c > 

Since Ax > b, A'x > — c is unsatisfiable, let a = (a\, . . . , cr r ) and a' be the row 
vector and real guaranteed to exist by Lemma A. 17. 

If case 3(a) of Lemma A. 17 applies, then the situation is identical to that of 
Lemma A. 16, and the same argument shows that / is inconsistent. If case (3b) of 
Lemma A. 17 applies, then a' > 0. As before, either by axiom F5 or by Lemma A. 15, 
we can multiply both sides of the j th conjunct in the formula / + by , for 1 < j < r. 
This results in the following system of inequalities: 

ciffli.i^H \-(ria>i,kVk > S\c\ 

(14) 

O r a r% \V\ + • • • + (7 r O-r,kVk ^ <J r C r . 

Similarly, by F5, we can multiply both sides of g io by a' to get ~^{a'a\V\ + 
...o-'a k v k ><r'c'). 

Let a'[v\ + • • • + a'^v k > d be the result of "adding" all the inequalities in (14). 
This inequality is provable from / using F4. Since a A + a' A' = 0, and A' = 
[— ai, . . . , — a k ], we must have that — a'aj = —ct", for j = 1, . . . , k. Thus, gi Q => 
^{a"v\ + • • • + a'^Vk > cr'c') is provable. Since ab — cr'c' > 0, it follows that d > cr'c'. 
Therefore, by F6, a'{v\ + ■ ■ ■ a'lv k > d => a'[v\ + ■ ■ ■ a' k Vh > cr'c! is provable. Taking 
the contrapositivc, we get that gi => -^(a'{v\ + • • • + a'^v k > d) is provable. But 
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/+ => a"v\ + • • • + a'lvk > d is also provable. Since / =>■ /+ A gi is obviously 
provable, it follows by propositional reasoning that -1/ is provable, that is, / is 
inconsistent, as desired. □ 

As with L\ , the proof of NP-complctencss for the decision problem of formulas 
about linear inequalities (with integer coefficients) over real-valued functions with 
nonempty domain relies on the following small-model result. Here, a "small model" 
for a formula is an assignment of functions with a small domain. This can be done 
quickly, as we shall see. 

Lemma A. 18. Suppose that f is a satisfiable inequality formula. Then f has a 
satisfying assignment where there are at most \ f\ functions in the assignment with 
a non-zero range, the functions in the assignment have a domain of size at most 
|/|, and every value in the range of the functions is a rational number with size 

0(1/111/11 + l/l iog(|/|)). 

PROOF. As usual, we can assume without loss of generality that / is a conjunc- 
tion of inequality formulas and their negations. Suppose that / has a satisfying 
assignment v\ , . . . , v k , over a domain D. Let / + be the conjunction of the inequality 
formulas in r, and let g\,...,g s be the negations of inequality formulas in /. 
Consider two cases, depending on whether s = 0. If s = 0, pick some element 
d of D. Clearly, v'l(d), . . . , vl(d) is a solution to /, and thus / is satisfiable over the 
reals. By Theorem 4.9 in FHM, / is satisfiable with a solution x\,...,x* k where at 
most l/l entries are nonzero, and each nonzero value is a rational number of size 
0(|/|||/|| + l/l log(|/|)). From this solution, we can construct a solution F* , . . . ,F k 
on the domain D' = {d} satisfying the conditions of the theorem, by simply taking 
F*(d) = x*. 

Now suppose that s > 0. Assume / is satisfiable over functions, with a solution 
Fi,...,F% over a domain D. Clearly, for any d e D, F*(d), . . . , F k (d) is a solution 
to / + . For any 1 < i < s, consider g{ — ^(a\V\ + . . . + a^v^ > c). There must 
be a d e D such that aiFf(d) + . . . + a k F£(d) < c. Thus, F?(d), F^(d) is a 
solution to §i, and by the above is also a solution to /+. Thus, /+ A g is satisfiable 
over the reals. Ag sin by Theorem 4.9 in FHM, we hcive a, solution ^, . . . , ^ of 

the inequalities / + A gi such that at most |/| entries in the solution are nonzero, 
and each nonzero value is of size 0(|/|||/|| + |/| log(|/|)). Let D = {di, . . . ,d s }. 
We construct a solution to /+ A gi A • • • A g s from those solutions. Define the 
functions Fi , . . . , F k over D such that F*(di) — x* i . it is easy to verify that 
/ = / + A A . . . A g s is satisfied by those functions. Intuitively, for every element 
di of the domain, / + is satisfied by F*(di), . . . , F£(di); moreover, each (of the 
form -i(ai-Fi + . . . + a k F k > c) must be satisfied, since by choice of di, we have 
a\Fi{di) + . . . + akF k (di) < c. Clearly this assignment Ff, . . . ,F£ satisfies the 
statement of the lemma. □ 

Theorem 7.4. The problem of deciding whether a formula about linear inequali- 
ties (with integer coefficients) is satisfiable over real-valued functions with nonempty 
domain is NP-complete. 

PROOF. For the lower bound, note that we can reduce propositional satisfiability 
to satisfiability in the logic of linear inequalities by simply replacing each primitive 
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proposition pi in a propositional formula by the inequality Vi > 0. 

For the upper bound, let / be a satisfiable inequality formula. We guess a small 
satisfying assignment where the domain D of the functions has size at most |/|; 
such an assignment is guaranteed to exist if / is satisfiable, by Lemma A. 18. It is 
easy to verify that this assignment does indeed satisfy / in time polynomial in |/| 
and 11/11- □ 
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